diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 88697e71a..806bb678e 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -50,6 +50,12 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): default=False, optional=True, ), + requirements.BooleanRequirement( + name="friendly", + description="Display process name in dump filename", + default=False, + optional=True, + ), ] @classmethod @@ -60,6 +66,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): pe_table_name: str, proc: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface], + friendly: bool = False, ) -> interfaces.plugins.FileHandlerInterface: """Extracts the complete data for a process as a FileHandlerInterface @@ -90,9 +97,20 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): offset=peb.ImageBaseAddress, layer_name=proc_layer_name, ) - file_handle = open_method( - f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp" + + process_name = proc.ImageFileName.cast( + "string", + max_length=proc.ImageFileName.vol.count, + errors="replace", ) + if friendly: + file_handle = open_method( + f"{proc.UniqueProcessId}.{process_name}.{peb.ImageBaseAddress:#x}.dmp" + ) + else: + file_handle = open_method( + f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp" + ) for offset, data in dos_header.reconstruct(): file_handle.seek(offset) file_handle.write(data) @@ -243,6 +261,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): pe_table_name, proc, self.open, + self.config["friendly"], ) file_output = "Error outputting file" if file_handle: