diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 99f31fb62..71480c86f 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -36,8 +36,10 @@ class CmdLine(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index d1ccadeb1..171b845fe 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -52,7 +52,11 @@ class DllDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] def _generator(self, procs): pe_table_name = intermed.IntermediateSymbolTable.create( diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 7f872f357..ac7afe7fb 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -36,8 +36,10 @@ class DllList(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 180d1fe50..c358e45bb 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -55,8 +55,10 @@ class Handles(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _decode_pointer(self, value, magic): """Windows encodes pointers to objects and decodes them on the fly diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 4e665d4a6..7faffacf1 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -37,8 +37,10 @@ class Malfind(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] @classmethod def is_vad_empty(self, proc_layer, vad): diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 202ceec01..0dc14f0b4 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -45,8 +45,10 @@ class ProcDump(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 8ed738328..8a5531039 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -45,13 +45,10 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): name = 'physical', description = 'Display physical offsets instead of virtual', default = cls.PHYSICAL_DEFAULT, - optional = True) - ] + cls.list_processes_filter_requirements - - list_processes_filter_requirements = [ - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) - ] + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 814161294..f9b9f28b8 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -47,7 +47,11 @@ class VadDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index e83543281..b3f541725 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -66,7 +66,11 @@ class VadInfo(interfaces.plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] @classmethod def protect_values(cls, context: interfaces.context.ContextInterface, virtual_layer: str, diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 1c245f3de..811a322e7 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -53,8 +53,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface): name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", - optional = True) - ] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self):