Add in rudimentary string support for pslist, consider changing it to user an obejct_class rather than casting.

2026-09-28 04:24:53 +02:00 · 2016-02-14 02:51:48 +00:00
parent d7aefdce28
commit 35e2c4a247
1 changed files with 5 additions and 2 deletions
@@ -35,7 +35,9 @@ class PsList(plugins.PluginInterface):

    def _generator(self, eproc):
        for proc in eproc.ActiveProcessLinks:
-            yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId))
+            yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
+                       proc.ImageFileName.cast("String", max_length = proc.ImageFileName.vol.count,
+                                               errors = 'replace')))

    def run(self):

@@ -46,5 +48,6 @@ class PsList(plugins.PluginInterface):
                                                          self.config['offset'])

        return TreeGrid([("PID", int),
-                         ("PPID", int)],
+                         ("PPID", int),
+                         ("ImageFileName", str)],
                        self._generator(eproc))