From 186b1ed1c2087a5e28edbf972f603c8c03ca26bf Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 10 May 2023 09:49:11 +0900 Subject: [PATCH 1/3] Add more process information to mac.pslist plugin Enhance the PsList plugin by including additional process information such as offset, UID, GID, and start time in the output. Update the TreeGrid columns to display the new information. --- volatility3/framework/plugins/mac/pslist.py | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index 1d97216bf..f88715c9c 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import datetime import logging from typing import Callable, Iterable, List, Dict @@ -9,6 +10,7 @@ from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols import mac +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -105,10 +107,19 @@ class PsList(interfaces.plugins.PluginInterface): self.config["kernel"], filter_func=self.create_pid_filter(self.config.get("pid", None)), ): - pid = task.p_pid - ppid = task.p_ppid + offset = format_hints.Hex(task.vol.offset) name = utility.array_to_string(task.p_comm) - yield (0, (pid, ppid, name)) + pid = task.p_pid + uid = task.p_uid + gid = task.p_gid + start_time_seconds = task.p_start.tv_sec + start_time_microseconds = task.p_start.tv_usec + start_time = datetime.datetime.fromtimestamp(start_time_seconds + start_time_microseconds / 1e6) + + + ppid = task.p_ppid + + yield (0, (offset, name, pid, uid, gid, start_time, ppid)) @classmethod def list_tasks_allproc( @@ -310,5 +321,5 @@ class PsList(interfaces.plugins.PluginInterface): def run(self): return renderers.TreeGrid( - [("PID", int), ("PPID", int), ("COMM", str)], self._generator() + [("OFFSET", format_hints.Hex), ("NAME", str), ("PID", int), ("UID", int), ("GID", int), ("Start Time", datetime.datetime), ("PPID", int)], self._generator() ) From 396daa528c1028e559ac626571f8894e35450f3e Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 10 May 2023 10:07:09 +0900 Subject: [PATCH 2/3] Apply Black Python linter to mac.pslist plugin Applied the Black Python linter to the mac PsList plugin, resulting in more readable and consistent code formatting. --- volatility3/framework/plugins/mac/pslist.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index f88715c9c..dbed09818 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -114,11 +114,12 @@ class PsList(interfaces.plugins.PluginInterface): gid = task.p_gid start_time_seconds = task.p_start.tv_sec start_time_microseconds = task.p_start.tv_usec - start_time = datetime.datetime.fromtimestamp(start_time_seconds + start_time_microseconds / 1e6) - + start_time = datetime.datetime.fromtimestamp( + start_time_seconds + start_time_microseconds / 1e6 + ) ppid = task.p_ppid - + yield (0, (offset, name, pid, uid, gid, start_time, ppid)) @classmethod @@ -321,5 +322,14 @@ class PsList(interfaces.plugins.PluginInterface): def run(self): return renderers.TreeGrid( - [("OFFSET", format_hints.Hex), ("NAME", str), ("PID", int), ("UID", int), ("GID", int), ("Start Time", datetime.datetime), ("PPID", int)], self._generator() + [ + ("OFFSET", format_hints.Hex), + ("NAME", str), + ("PID", int), + ("UID", int), + ("GID", int), + ("Start Time", datetime.datetime), + ("PPID", int), + ], + self._generator(), ) From f8fc5d5e58495d9f45d900cd9041ba37d0d078dc Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 12 Jul 2023 14:43:38 +0900 Subject: [PATCH 3/3] Update pslist.py list modules in code in alphabetical order --- volatility3/framework/plugins/mac/pslist.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index dbed09818..88045a277 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -4,13 +4,13 @@ import datetime import logging -from typing import Callable, Iterable, List, Dict +from typing import Callable, Dict, Iterable, List -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility -from volatility3.framework.symbols import mac from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__)