WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor create_filter to create_pid_filter.

Browse Source
This commit is contained in:
Mike Auty
2019-04-18 01:10:07 +01:00
parent 603512122d
commit 754b3f0bc6
23 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/bash.py
+2 -2
View File
@@ -98,7 +98,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
@@ -110,7 +110,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
pslist.PsList.list_tasks(
volatility/framework/plugins/linux/elfs.py
+1 -1
View File
@@ -62,7 +62,7 @@ class Elfs(plugins.PluginInterface):
yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("File Path", str)],
volatility/framework/plugins/linux/lsof.py
+1 -1
View File
@@ -56,7 +56,7 @@ class Lsof(plugins.PluginInterface):
def run(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)],
self._generator(
volatility/framework/plugins/linux/malfind.py
+1 -1
View File
@@ -79,7 +79,7 @@ class Malfind(interfaces_plugins.PluginInterface):
vma.get_protection(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes),
volatility/framework/plugins/linux/proc.py
+1 -1
View File
@@ -69,7 +69,7 @@ class Maps(plugins.PluginInterface):
format_hints.Hex(page_offset), major, minor, inode, path))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str),
("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str),
volatility/framework/plugins/linux/pslist.py
+2 -2
View File
@@ -39,7 +39,7 @@ class PsList(interfaces_plugins.PluginInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
filter_list = [x for x in pid_list if x is not None]
@@ -57,7 +57,7 @@ class PsList(interfaces_plugins.PluginInterface):
self.context,
self.config['primary'],
self.config['vmlinux'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
pid = task.pid
ppid = 0
if task.parent:
volatility/framework/plugins/mac/bash.py
+2 -2
View File
@@ -100,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command()))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime),
("Command", str)],
@@ -112,7 +112,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
filter_func = filter_func)))
def generate_timeline(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
pslist.PsList.list_tasks(
volatility/framework/plugins/mac/malfind.py
+1 -1
View File
@@ -77,7 +77,7 @@ class Malfind(interfaces_plugins.PluginInterface):
vma.get_perms(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex),
("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes),
volatility/framework/plugins/mac/netstat.py
+1 -1
View File
@@ -68,7 +68,7 @@ class Netstat(plugins.PluginInterface):
def run(self):
# mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int),
("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)],
volatility/framework/plugins/mac/psaux.py
+1 -1
View File
@@ -100,7 +100,7 @@ class Psaux(plugins.PluginInterface):
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
def run(self) -> renderers.TreeGrid:
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(
volatility/framework/plugins/mac/pslist.py
+2 -2
View File
@@ -42,7 +42,7 @@ class PsList(interfaces_plugins.PluginInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
filter_func = lambda _: False
# FIXME: mypy #4973 or #2608
@@ -61,7 +61,7 @@ class PsList(interfaces_plugins.PluginInterface):
self.context,
self.config['primary'],
self.config['darwin'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
pid = task.p_pid
ppid = task.p_ppid
name = utility.array_to_string(task.p_comm)
volatility/framework/plugins/windows/cmdline.py
+1 -1
View File
@@ -64,7 +64,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)],
self._generator(
volatility/framework/plugins/windows/dlldump.py
+1 -1
View File
@@ -107,7 +107,7 @@ class DllDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/dlllist.py
+1 -1
View File
@@ -61,7 +61,7 @@ class DllList(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex),
("Size", format_hints.Hex), ("Name", str), ("Path", str)],
volatility/framework/plugins/windows/handles.py
+1 -1
View File
@@ -312,7 +312,7 @@ class Handles(interfaces_plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex),
("HandleValue", format_hints.Hex), ("Type", str),
volatility/framework/plugins/windows/malfind.py
+1 -1
View File
@@ -123,7 +123,7 @@ class Malfind(interfaces.plugins.PluginInterface):
vad.get_commit_charge(), vad.get_private_memory(), format_hints.HexBytes(data), disasm))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex),
("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str),
volatility/framework/plugins/windows/moddump.py
+1 -1
View File
@@ -61,7 +61,7 @@ class ModDump(interfaces_plugins.PluginInterface):
<list> of layer names
"""
seen_ids = [] # type: List[interfaces.objects.ObjectInterface]
filter_func = pslist.PsList.create_filter(pids or [])
filter_func = pslist.PsList.create_pid_filter(pids or [])
for proc in pslist.PsList.list_processes(
context = context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func):
volatility/framework/plugins/windows/procdump.py
+1 -1
View File
@@ -88,7 +88,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/pslist.py
+2 -2
View File
@@ -53,7 +53,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
]
@classmethod
def create_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
filter_func = lambda _: False
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
@@ -102,7 +102,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
self.context,
self.config['primary'],
self.config['nt_symbols'],
filter_func = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_pid_filter([self.config.get('pid', None)])):
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
offset = proc.vol.offset
volatility/framework/plugins/windows/vaddump.py
+1 -1
View File
@@ -87,7 +87,7 @@ class VadDump(interfaces_plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)],
self._generator(
volatility/framework/plugins/windows/vadinfo.py
+1 -1
View File
@@ -117,7 +117,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex),
("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str),
volatility/framework/plugins/windows/vadyarascan.py
+1 -1
View File
@@ -74,7 +74,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
for task in pslist.PsList.list_processes(
context = self.context,