diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 1e0f20be3..237c0edcd 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -24,7 +24,6 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) _version = (1, 1, 0) - PHYSICAL_DEFAULT = False @classmethod def get_requirements(cls): @@ -43,7 +42,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): optional = True), requirements.BooleanRequirement(name = 'physical', description = "Display physical offset instead of virtual", - default = cls.PHYSICAL_DEFAULT, + default = False, optional = True) ] @@ -153,8 +152,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): "windows", "pe", class_types = pe.class_types) - memory = self.context.layers[kernel.layer_name] - + memory = self.context.layers[kernel.layer_name] if not isinstance(memory, layers.intel.Intel): raise TypeError("Primary layer is not an intel layer") @@ -179,23 +177,20 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if file_handle: file_output = file_handle.preferred_filename - if not self.config.get('physical', self.PHYSICAL_DEFAULT): + if not self.config['physical']: offset = proc.vol.offset else: (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] try: - yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time(), file_output)) - except exceptions.InvalidAddressException: vollog.info(f"Invalid process found at address: {proc.vol.offset:x}. Skipping") - def generate_timeline(self): for row in self._generator(): _depth, row_data = row @@ -204,8 +199,9 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9]) def run(self): - return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset" + - "(V)" if (not self.config["physical"]) else "(P)", format_hints.Hex), - ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), + offsettype = "(V)" if not self.config['physical'] else "(P)" + return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), + (f"Offset{offsettype}", format_hints.Hex), ("Threads", int), + ("Handles", int), ("SessionId", int), ("Wow64", bool), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime), ("File output", str)], self._generator())