diff --git a/volatility/plugins/linux/bash.py b/volatility/plugins/linux/bash.py index f190e0ed1..10bd3a40a 100644 --- a/volatility/plugins/linux/bash.py +++ b/volatility/plugins/linux/bash.py @@ -11,10 +11,11 @@ from volatility.framework.interfaces import plugins from volatility.framework.layers import scanners from volatility.framework.objects import utility from volatility.framework.symbols.linux.bash import BashIntermedSymbols +from volatility.plugins import timeliner from volatility.plugins.linux import pslist -class Bash(plugins.PluginInterface): +class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory""" @classmethod @@ -90,3 +91,16 @@ class Bash(plugins.PluginInterface): self.config['primary'], self.config['vmlinux'], filter = filter))) + + def generate_timeline(self): + filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + + plugin = pslist.PsList.list_tasks + + for row in self._generator(plugin(self.context, + self.config['primary'], + self.config['vmlinux'], + filter = filter)): + _depth, row_data = row + description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) + yield (description, timeliner.TimeLinerType.CREATED, row_data[2])