diff --git a/volatility/plugins/windows/malfind.py b/volatility/plugins/windows/malfind.py index 4d8029f17..a828761ed 100644 --- a/volatility/plugins/windows/malfind.py +++ b/volatility/plugins/windows/malfind.py @@ -70,7 +70,6 @@ class Malfind(interfaces_plugins.PluginInterface): yield vad, data def _generator(self, procs): - vadinfo_plugin = vadinfo.VadInfo(self.context, self.config_path) # determine if we're on a 32 or 64 bit kernel @@ -105,8 +104,6 @@ class Malfind(interfaces_plugins.PluginInterface): def run(self): - plugin = pslist.PsList(self.context, self.config_path) - return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex), @@ -117,4 +114,6 @@ class Malfind(interfaces_plugins.PluginInterface): ("PrivateMemory", int), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)], - self._generator(plugin.list_processes())) + self._generator(pslist.PsList.list_processes(self.context, + self.config['primary'], + self.config['nt_symbols']))) diff --git a/volatility/plugins/windows/pstree.py b/volatility/plugins/windows/pstree.py index 084e7bc83..45ee25bd7 100644 --- a/volatility/plugins/windows/pstree.py +++ b/volatility/plugins/windows/pstree.py @@ -27,7 +27,7 @@ class PsTree(pslist.PsList): def _generator(self): """Generates the """ - for proc in self.list_processes(): + for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols']): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset