
    [
#g                         d dl Z d dlmZmZmZmZ d dlmZmZ d dl	m
Z
 d dlmZmZ  e j                  e      Z G d dej"                        Zy)    N)CallableIterableList	Generator)
interfaces	constants)requirements)pslistthrdscanc                   X    e Zd ZdZdZdZ fdZedee	j                  j                     fd       Zede	j                  j                  dee	j                  j                  ddf   fd	       Zed
e	j"                  j$                  dedee	j                  j                     fd       Z xZS )ThreadszLists process threads)      r   )   r   r   c                 F    t        |   |i | | j                  | _        y )N)super__init__list_process_threadsimplementation)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/threads.pyr   zThreads.__init__   s#    $)&)"77    returnc                     t        j                  ddddg      t        j                  ddt        d	      t        j                  d
t
        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r!   r"   element_typeoptionalr   )r   r   r   )r!   pluginversion)r	   ModuleRequirementListRequirementintPluginRequirementr   ThrdScan)clss    r   get_requirementszThreads.get_requirements   sc     **,()4
 ((< 	 **(9(99
 	
r   procNc              #   "  K   t               }|j                  j                  |j                   t        j
                   dd      D ]E  }|j                  j                  |v r y|j                  |j                  j                         | G yw)zLists the Threads of a specific process.

        Args:
            proc: _EPROCESS object from which to list the VADs

        Returns:
            A list of threads based on the process and filtered based on the filter function
        _ETHREADThreadListEntryN)	setThreadListHeadto_listsymbol_table_namer   BANGvoloffsetadd)r.   r   r0   seenthreads        r   list_threadszThreads.list_threads-   sy      u))11''((8ACT
F zz  D(HHVZZ&&'L
s   BBcontextmodule_namec              #   R  K   |j                   |   }|j                  }|j                  }t        j                  j                  |j                  j                  dd            }t        j                  j                  ||||      D ]  }| j                  ||      D ]  }|   yw)z=Runs through all processes and lists threads for each processr$   N)r?   
layer_namesymbol_tablefilter_func)
modulesrB   r7   r
   PsListcreate_pid_filterconfiggetlist_processesr>   )	r.   r?   r@   modulerB   r7   rD   r0   r=   s	            r   r   zThreads.list_process_threadsB   s      -&&
"44mm55gnn6H6HPT6UVMM00!*#	 1 
D **648 9
s   B%B')__name__
__module____qualname____doc___required_framework_version_versionr   classmethodr   r   configurationRequirementInterfacer/   objectsObjectInterfacer   r>   r?   ContextInterfacestrr   r   __classcell__)r   s   @r   r   r      s    "+H8 
j&>&>&S&S!T 
 
& %--==	:%%55tTA	B ( ##44  
*$$44	5	 r   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr	   volatility3.plugins.windowsr
   r   	getLoggerrL   vollogr-   r    r   r   <module>rb      s?   
  6 6 7 < 8			8	$Gh Gr   