diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 3f4322528..222862f8e 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -98,7 +98,7 @@ that will be output as part of the `TreeGrid`. def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -113,7 +113,7 @@ that will be output as part of the `TreeGrid`. In this instance, the plugin constructs a filter (using the PsList plugin's `classmethod` for creating filters). It passes checks the plugin's configuration for the `pid` value, and passes it in as a list if it finds it, or None if -it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_filter` method accepts a list of process +it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process identifiers that are included in the list, if the list is empty all processes are returned. The next line specifies the columns by their name and type. The types are simple types (`int`, `str`, `bytes`, `float`, `bool`) diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index bf7e5a88b..91da9d561 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -98,7 +98,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command())) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], @@ -110,7 +110,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): filter_func = filter_func))) def generate_timeline(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) for row in self._generator( pslist.PsList.list_tasks( diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index 35f34b9c1..95b106396 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -62,7 +62,7 @@ class Elfs(plugins.PluginInterface): yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("File Path", str)], diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index 547995854..aec1c1b99 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -56,7 +56,7 @@ class Lsof(plugins.PluginInterface): def run(self): linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)], self._generator( diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index f48d46ff3..031795036 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -79,7 +79,7 @@ class Malfind(interfaces_plugins.PluginInterface): vma.get_protection(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index e640c7290..c5279553d 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -69,7 +69,7 @@ class Maps(plugins.PluginInterface): format_hints.Hex(page_offset), major, minor, inode, path)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str), diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 154332de8..03b91f452 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -39,7 +39,7 @@ class PsList(interfaces_plugins.PluginInterface): ] @classmethod - def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: + def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] @@ -57,7 +57,7 @@ class PsList(interfaces_plugins.PluginInterface): self.context, self.config['primary'], self.config['vmlinux'], - filter_func = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter([self.config.get('pid', None)])): pid = task.pid ppid = 0 if task.parent: diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 300ef2006..ae7a1640f 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -100,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command())) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], @@ -112,7 +112,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): filter_func = filter_func))) def generate_timeline(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) for row in self._generator( pslist.PsList.list_tasks( diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index f08a0b02b..cafc31c91 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -77,7 +77,7 @@ class Malfind(interfaces_plugins.PluginInterface): vma.get_perms(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index fcc6bead2..56539e3d2 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -68,7 +68,7 @@ class Netstat(plugins.PluginInterface): def run(self): # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context) - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 00a513e33..07447ec0a 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -100,7 +100,7 @@ class Psaux(plugins.PluginInterface): yield (0, (task.p_pid, task_name, task.p_argc, args_str)) def run(self) -> renderers.TreeGrid: - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], self._generator( diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index bf7ce42bd..ed95e0d1b 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -42,7 +42,7 @@ class PsList(interfaces_plugins.PluginInterface): ] @classmethod - def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: + def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: filter_func = lambda _: False # FIXME: mypy #4973 or #2608 @@ -61,7 +61,7 @@ class PsList(interfaces_plugins.PluginInterface): self.context, self.config['primary'], self.config['darwin'], - filter_func = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter([self.config.get('pid', None)])): pid = task.p_pid ppid = task.p_ppid name = utility.array_to_string(task.p_comm) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index d1ed0c062..99f31fb62 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -64,7 +64,7 @@ class CmdLine(interfaces_plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)], self._generator( diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 4dea2cd37..681d54b6a 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -107,7 +107,7 @@ class DllDump(interfaces_plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 1af1128f7..7f872f357 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -61,7 +61,7 @@ class DllList(interfaces_plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str)], diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 6995a1d5e..83544ef01 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -312,7 +312,7 @@ class Handles(interfaces_plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("HandleValue", format_hints.Hex), ("Type", str), diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 0a780ebd3..681897a5e 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -123,7 +123,7 @@ class Malfind(interfaces.plugins.PluginInterface): vad.get_commit_charge(), vad.get_private_memory(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str), diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 712b1c0aa..124243c65 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -61,7 +61,7 @@ class ModDump(interfaces_plugins.PluginInterface): of layer names """ seen_ids = [] # type: List[interfaces.objects.ObjectInterface] - filter_func = pslist.PsList.create_filter(pids or []) + filter_func = pslist.PsList.create_pid_filter(pids or []) for proc in pslist.PsList.list_processes( context = context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func): diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 4bffb2d35..6b34c5505 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -88,7 +88,7 @@ class ProcDump(interfaces_plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 013bde32a..64bdf68f7 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -53,7 +53,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): ] @classmethod - def create_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: + def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: filter_func = lambda _: False # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] @@ -102,7 +102,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): self.context, self.config['primary'], self.config['nt_symbols'], - filter_func = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter([self.config.get('pid', None)])): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index bb3ba6b3a..396758d7c 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -87,7 +87,7 @@ class VadDump(interfaces_plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 2a3479f29..89e12b236 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -117,7 +117,7 @@ class VadInfo(interfaces.plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index e2090f562..2ef998ae4 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -74,7 +74,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) for task in pslist.PsList.list_processes( context = self.context,