WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #504 from doomedraven/patch-1

Browse Source 
ability to reverse filtering see long description
This commit is contained in:
ikelos
2021-05-23 16:58:35 +01:00
committed by GitHub
parent 4cb71366c7 dd6ad75b22
commit 069a3da751
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/pslist.py
+13 -6
View File
@@ -21,7 +21,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Lists the processes present in a particular windows memory image."""
_required_framework_version = (1, 0, 0)
_version = (2, 0, 0)
_version = (2, 0, 1)
PHYSICAL_DEFAULT = False
@classmethod
@@ -83,12 +83,13 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
return file_handle
@classmethod
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
def create_pid_filter(cls, pid_list: List[int] = None, exclude: bool = False) -> Callable[[interfaces.objects.ObjectInterface], bool]:
"""A factory for producing filter functions that filter based on a list
of process IDs.
Args:
pid_list: A list of process IDs that are acceptable, all other processes will be filtered out
exclude: Accept only tasks that are not in pid_list
Returns:
Filter function for passing to the `list_processes` method
@@ -98,17 +99,20 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
pid_list = pid_list or []
filter_list = [x for x in pid_list if x is not None]
if filter_list:
filter_func = lambda x: x.UniqueProcessId not in filter_list
if exclude:
filter_func = lambda x: x.UniqueProcessId in filter_list
else:
filter_func = lambda x: x.UniqueProcessId not in filter_list
return filter_func
@classmethod
def create_name_filter(cls, name_list: List[str] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
def create_name_filter(cls, name_list: List[str] = None, exclude: bool = False) -> Callable[[interfaces.objects.ObjectInterface], bool]:
"""A factory for producing filter functions that filter based on a list
of process names.
Args:
name_list: A list of process names that are acceptable, all other processes will be filtered out
exclude: Accept only tasks that are not in name_list
Returns:
Filter function for passing to the `list_processes` method
"""
@@ -117,7 +121,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
name_list = name_list or []
filter_list = [x for x in name_list if x is not None]
if filter_list:
filter_func = lambda x: utility.array_to_string(x.ImageFileName) not in filter_list
if exclude:
filter_func = lambda x: utility.array_to_string(x.ImageFileName) in filter_list
else:
filter_func = lambda x: utility.array_to_string(x.ImageFileName) not in filter_list
return filter_func
@classmethod