From 5bd0cf0e2eb083e5f87ad2cf2bff3a086eb341c0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 28 Aug 2020 01:43:41 +0100 Subject: [PATCH] Windows: Fix wrote attribute in cmdline plugin Fixes #316. --- volatility/framework/plugins/windows/cmdline.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 7798abc4f..ebfcf7da2 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -33,7 +33,7 @@ class CmdLine(interfaces.plugins.PluginInterface): ] @classmethod - def get_cmdline(cls, context: interfaces.context.ContextInterface, + def get_cmdline(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, proc): """Extracts the cmdline from PEB @@ -56,7 +56,6 @@ class CmdLine(interfaces.plugins.PluginInterface): return result_text - def _generator(self, procs): for proc in procs: @@ -75,11 +74,10 @@ class CmdLine(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException as exp: result_text = "Process {}: Required memory at {:#x} is not valid (incomplete layer {}?)".format( - proc_id, exp.invalid_address, exp.layer) + proc_id, exp.invalid_address, exp.layer_name) - yield (0, (proc.UniqueProcessId, process_name, result_text)) - + def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))