WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor create_filter to create_pid_filter.

Browse Source
This commit is contained in:
Mike Auty
2019-04-18 01:10:07 +01:00
parent 603512122d
commit 754b3f0bc6
23 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/simple-plugin.rst
+2 -2
View File
@@ -98,7 +98,7 @@ that will be output as part of the `TreeGrid`.
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -113,7 +113,7 @@ that will be output as part of the `TreeGrid`.
In this instance, the plugin constructs a filter (using the PsList plugin's `classmethod` for creating filters).
It passes checks the plugin's configuration for the `pid` value, and passes it in as a list if it finds it, or None if
it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_filter` method accepts a list of process
it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process
identifiers that are included in the list, if the list is empty all processes are returned.
The next line specifies the columns by their name and type. The types are simple types (`int`, `str`, `bytes`, `float`, `bool`)
volatility/framework/plugins/linux/bash.py
+2 -2
View File
@@ -98,7 +98,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
@@ -110,7 +110,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
pslist.PsList.list_tasks(
volatility/framework/plugins/linux/elfs.py
+1 -1
View File
@@ -62,7 +62,7 @@ class Elfs(plugins.PluginInterface):
yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("File Path", str)],
volatility/framework/plugins/linux/lsof.py
+1 -1
View File
@@ -56,7 +56,7 @@ class Lsof(plugins.PluginInterface):
def run(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)],
self._generator(
volatility/framework/plugins/linux/malfind.py
+1 -1
View File
@@ -79,7 +79,7 @@ class Malfind(interfaces_plugins.PluginInterface):
vma.get_protection(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes),
volatility/framework/plugins/linux/proc.py
+1 -1
View File
@@ -69,7 +69,7 @@ class Maps(plugins.PluginInterface):
format_hints.Hex(page_offset), major, minor, inode, path))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str),
("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str),
volatility/framework/plugins/linux/pslist.py
+2 -2
View File
@@ -39,7 +39,7 @@ class PsList(interfaces_plugins.PluginInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
filter_list = [x for x in pid_list if x is not None]
@@ -57,7 +57,7 @@ class PsList(interfaces_plugins.PluginInterface):
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
pid = task.pid
ppid = 0
if task.parent:
volatility/framework/plugins/mac/bash.py
+2 -2
View File
@@ -100,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command()))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
@@ -112,7 +112,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
pslist.PsList.list_tasks(
volatility/framework/plugins/mac/malfind.py
+1 -1
View File
@@ -77,7 +77,7 @@ class Malfind(interfaces_plugins.PluginInterface):
vma.get_perms(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes),
volatility/framework/plugins/mac/netstat.py
+1 -1
View File
@@ -68,7 +68,7 @@ class Netstat(plugins.PluginInterface):
def run(self):
# mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int),
("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)],
volatility/framework/plugins/mac/psaux.py
+1 -1
View File
@@ -100,7 +100,7 @@ class Psaux(plugins.PluginInterface):
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
def run(self) -> renderers.TreeGrid:
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(
volatility/framework/plugins/mac/pslist.py
+2 -2
View File
@@ -42,7 +42,7 @@ class PsList(interfaces_plugins.PluginInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
filter_func = lambda _: False
# FIXME: mypy #4973 or #2608
@@ -61,7 +61,7 @@ class PsList(interfaces_plugins.PluginInterface):
self.context,
self.config['primary'],
self.config['darwin'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
pid = task.p_pid
ppid = task.p_ppid
name = utility.array_to_string(task.p_comm)
volatility/framework/plugins/windows/cmdline.py
+1 -1
View File
@@ -64,7 +64,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)],
self._generator(
volatility/framework/plugins/windows/dlldump.py
+1 -1
View File
@@ -107,7 +107,7 @@ class DllDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/dlllist.py
+1 -1
View File
@@ -61,7 +61,7 @@ class DllList(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex),
("Size", format_hints.Hex), ("Name", str), ("Path", str)],
volatility/framework/plugins/windows/handles.py
+1 -1
View File
@@ -312,7 +312,7 @@ class Handles(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex),
("HandleValue", format_hints.Hex), ("Type", str),
volatility/framework/plugins/windows/malfind.py
+1 -1
View File
@@ -123,7 +123,7 @@ class Malfind(interfaces.plugins.PluginInterface):
vad.get_commit_charge(), vad.get_private_memory(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex),
("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str),
volatility/framework/plugins/windows/moddump.py
+1 -1
View File
@@ -61,7 +61,7 @@ class ModDump(interfaces_plugins.PluginInterface):
<list> of layer names
"""
seen_ids = [] # type: List[interfaces.objects.ObjectInterface]
filter_func = pslist.PsList.create_filter(pids or [])
filter_func = pslist.PsList.create_pid_filter(pids or [])
for proc in pslist.PsList.list_processes(
context = context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func):
volatility/framework/plugins/windows/procdump.py
+1 -1
View File
@@ -88,7 +88,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/pslist.py
+2 -2
View File
@@ -53,7 +53,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
filter_func = lambda _: False
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
@@ -102,7 +102,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
self.context,
self.config['primary'],
self.config['nt_symbols'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
offset = proc.vol.offset
volatility/framework/plugins/windows/vaddump.py
+1 -1
View File
@@ -87,7 +87,7 @@ class VadDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/vadinfo.py
+1 -1
View File
@@ -117,7 +117,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex),
("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str),
volatility/framework/plugins/windows/vadyarascan.py
+1 -1
View File
@@ -74,7 +74,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for task in pslist.PsList.list_processes(
context = self.context,