WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-27 20:14:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up filtering in mac and remove the last of the filter shadowing.

Browse Source
This commit is contained in:
Mike Auty
2019-02-28 09:48:15 +00:00
parent c5e2490f40
commit 2aa07596c2
12 changed files with 91 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/bash.py
+10 -8
View File
@@ -100,19 +100,21 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func)))
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
for row in self._generator(
plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func)):
pslist.PsList.list_tasks(
self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])
volatility/framework/plugins/linux/elfs.py
+8 -6
View File
@@ -64,9 +64,11 @@ class Elfs(plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex),
("File Path", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func)))
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("File Path", str)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = filter_func)))
volatility/framework/plugins/linux/lsof.py
+8 -6
View File
@@ -56,10 +56,12 @@ class Lsof(plugins.PluginInterface):
def run(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("FD", int), ("Path", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter)))
return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = filter_func)))
volatility/framework/plugins/linux/malfind.py
+9 -6
View File
@@ -81,9 +81,12 @@ class Malfind(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex),
("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func)))
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes),
("Disasm", interfaces_renderers.Disassembly)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = filter_func)))
volatility/framework/plugins/linux/proc.py
+11 -7
View File
@@ -69,11 +69,15 @@ class Maps(plugins.PluginInterface):
format_hints.Hex(page_offset), major, minor, inode, path))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str),
("PgOff", format_hints.Hex), ("Major", int), ("Minor", int), ("Inode", int), ("File Path", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter)))
return renderers.TreeGrid([("PID", int), ("Process", str),
("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str),
("PgOff", format_hints.Hex), ("Major", int), ("Minor", int), ("Inode", int),
("File Path", str)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = filter_func)))
volatility/framework/plugins/linux/pslist.py
+4 -3
View File
@@ -57,7 +57,7 @@ class PsList(interfaces_plugins.PluginInterface):
self.context,
self.config['primary'],
self.config['vmlinux'],
filter = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_filter([self.config.get('pid', None)])):
pid = task.pid
ppid = 0
if task.parent:
@@ -70,7 +70,8 @@ class PsList(interfaces_plugins.PluginInterface):
context: interfaces.context.ContextInterface,
layer_name: str,
vmlinux_symbols: str,
filter: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]:
filter_func: Callable[[int], bool] = lambda _: False
) -> Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
@@ -79,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface):
init_task = vmlinux.object(symbol_name = "init_task")
for task in init_task.tasks:
if not filter(task):
if not filter_func(task):
yield task
def run(self):