WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-10-01 05:54:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up filtering in mac and remove the last of the filter shadowing.

Browse Source
This commit is contained in:
Mike Auty
2019-02-28 09:48:15 +00:00
parent c5e2490f40
commit 2aa07596c2
12 changed files with 91 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/bash.py
+11 -9
View File
@@ -100,21 +100,23 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command()))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
self._generator(
pslist.PsList.list_tasks(
self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
for row in self._generator(
plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter_func)):
pslist.PsList.list_tasks(
self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])