From 5c80a66d6dd9b3bc2400a4a8062ed30add10ce4b Mon Sep 17 00:00:00 2001
From: 616c696365 <616c696365@localhost.com>
Date: Wed, 30 Aug 2023 20:12:12 +0100
Subject: [PATCH] Windows: Update pslist.py, add friendly option

---
 .../framework/plugins/windows/pslist.py       | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py
index 88697e71a..806bb678e 100644
--- a/volatility3/framework/plugins/windows/pslist.py
+++ b/volatility3/framework/plugins/windows/pslist.py
@@ -50,6 +50,12 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 default=False,
                 optional=True,
             ),
+            requirements.BooleanRequirement(
+                name="friendly",
+                description="Display process name in dump filename",
+                default=False,
+                optional=True,
+            ),
         ]
 
     @classmethod
@@ -60,6 +66,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         pe_table_name: str,
         proc: interfaces.objects.ObjectInterface,
         open_method: Type[interfaces.plugins.FileHandlerInterface],
+        friendly: bool = False,
     ) -> interfaces.plugins.FileHandlerInterface:
         """Extracts the complete data for a process as a FileHandlerInterface
 
@@ -90,9 +97,20 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 offset=peb.ImageBaseAddress,
                 layer_name=proc_layer_name,
             )
-            file_handle = open_method(
-                f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp"
+
+            process_name = proc.ImageFileName.cast(
+                "string",
+                max_length=proc.ImageFileName.vol.count,
+                errors="replace",
             )
+            if friendly:
+                file_handle = open_method(
+                    f"{proc.UniqueProcessId}.{process_name}.{peb.ImageBaseAddress:#x}.dmp"
+                )
+            else:
+                file_handle = open_method(
+                    f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp"
+                )
             for offset, data in dos_header.reconstruct():
                 file_handle.seek(offset)
                 file_handle.write(data)
@@ -243,6 +261,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                         pe_table_name,
                         proc,
                         self.open,
+                        self.config["friendly"],
                     )
                     file_output = "Error outputting file"
                     if file_handle: