Windows: Update pslist.py, add friendly option

volatility3/framework/plugins/windows/pslist.py

@@ -50,6 +50,12 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 default=False,
                 optional=True,
             ),
+            requirements.BooleanRequirement(
+                name="friendly",
+                description="Display process name in dump filename",
+                default=False,
+                optional=True,
+            ),
         ]
 
     @classmethod
@@ -60,6 +66,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         pe_table_name: str,
         proc: interfaces.objects.ObjectInterface,
         open_method: Type[interfaces.plugins.FileHandlerInterface],
+        friendly: bool = False,
     ) -> interfaces.plugins.FileHandlerInterface:
         """Extracts the complete data for a process as a FileHandlerInterface
 
@@ -90,9 +97,20 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 offset=peb.ImageBaseAddress,
                 layer_name=proc_layer_name,
             )
-            file_handle = open_method(
-                f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp"
+
+            process_name = proc.ImageFileName.cast(
+                "string",
+                max_length=proc.ImageFileName.vol.count,
+                errors="replace",
             )
+            if friendly:
+                file_handle = open_method(
+                    f"{proc.UniqueProcessId}.{process_name}.{peb.ImageBaseAddress:#x}.dmp"
+                )
+            else:
+                file_handle = open_method(
+                    f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp"
+                )
             for offset, data in dos_header.reconstruct():
                 file_handle.seek(offset)
                 file_handle.write(data)
@@ -243,6 +261,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                         pe_table_name,
                         proc,
                         self.open,
+                        self.config["friendly"],
                     )
                     file_output = "Error outputting file"
                     if file_handle: