From 35e2c4a247dc2920b994b3743e210593ae384804 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 14 Feb 2016 02:51:48 +0000 Subject: [PATCH] Add in rudimentary string support for pslist, consider changing it to user an obejct_class rather than casting. --- volatility/plugins/windows/pslist.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index d5fc930bd..d190a2149 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -35,7 +35,9 @@ class PsList(plugins.PluginInterface): def _generator(self, eproc): for proc in eproc.ActiveProcessLinks: - yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId)) + yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, + proc.ImageFileName.cast("String", max_length = proc.ImageFileName.vol.count, + errors = 'replace'))) def run(self): @@ -46,5 +48,6 @@ class PsList(plugins.PluginInterface): self.config['offset']) return TreeGrid([("PID", int), - ("PPID", int)], + ("PPID", int), + ("ImageFileName", str)], self._generator(eproc))