Update plugins that used create_filter to filter on pids.

volatility/framework/plugins/windows/cmdline.py

@@ -37,7 +37,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
             requirements.TranslationLayerRequirement(
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self, procs):
 

volatility/framework/plugins/windows/dlldump.py

@@ -22,10 +22,11 @@ import logging
 import ntpath
 from typing import List
 
-import volatility.framework.constants as constants
-import volatility.framework.interfaces.plugins as interfaces_plugins
 import volatility.plugins.windows.pslist as pslist
 import volatility.plugins.windows.vadinfo as vadinfo
+
+import volatility.framework.constants as constants
+import volatility.framework.interfaces.plugins as interfaces_plugins
 from volatility.framework import interfaces
 from volatility.framework import renderers
 from volatility.framework.configuration import requirements
@@ -50,7 +51,7 @@ class DllDump(interfaces_plugins.PluginInterface):
                                             description = "Process virtual memory address to include " \
                                                           "(all other address ranges are excluded). This must be " \
                                                           "a base address, not an address within the desired range.",
-                                            optional = True)]
+                                            optional = True)] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self, procs):
         pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe")

volatility/framework/plugins/windows/dlllist.py

@@ -37,7 +37,7 @@ class DllList(interfaces_plugins.PluginInterface):
             requirements.TranslationLayerRequirement(
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self, procs):
 

volatility/framework/plugins/windows/handles.py

@@ -56,7 +56,7 @@ class Handles(interfaces_plugins.PluginInterface):
             requirements.TranslationLayerRequirement(
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     def _decode_pointer(self, value, magic):
         """Windows encodes pointers to objects and decodes them on the fly

volatility/framework/plugins/windows/malfind.py

@@ -20,6 +20,7 @@
 
 import volatility.plugins.windows.pslist as pslist
 import volatility.plugins.windows.vadinfo as vadinfo
+
 from volatility.framework import interfaces, symbols
 from volatility.framework import renderers
 from volatility.framework.configuration import requirements
@@ -37,7 +38,7 @@ class Malfind(interfaces.plugins.PluginInterface):
             requirements.TranslationLayerRequirement(
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     @classmethod
     def is_vad_empty(self, proc_layer, vad):

volatility/framework/plugins/windows/procdump.py

@@ -44,7 +44,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
             requirements.TranslationLayerRequirement(
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self, procs):
 

volatility/framework/plugins/windows/pslist.py

@@ -40,15 +40,17 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
                 name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
             # TODO: Convert this to a ListRequirement so that people can filter on sets of pids
-            requirements.IntRequirement(
-                name = 'pid', description = "Process ID to include (all other processes are excluded)",
-                optional = True),
             requirements.BooleanRequirement(
                 name = 'physical',
                 description = 'Display physical offsets instead of virtual',
                 default = cls.PHYSICAL_DEFAULT,
                 optional = True)
-        ]
+        ] + cls.list_processes_filter_requirements
+
+    list_processes_filter_requirements = [
+        requirements.IntRequirement(
+            name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
+    ]
 
     @classmethod
     def create_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:

volatility/framework/plugins/windows/vaddump.py

@@ -47,7 +47,7 @@ class VadDump(interfaces_plugins.PluginInterface):
                                             description = "Process virtual memory address to include " \
                                                           "(all other address ranges are excluded). This must be " \
                                                           "a base address, not an address within the desired range.",
-                                            optional = True)]
+                                            optional = True)] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self, procs):
 

volatility/framework/plugins/windows/vadinfo.py

@@ -66,7 +66,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
                                             description = "Process virtual memory address to include " \
                                                           "(all other address ranges are excluded). This must be " \
                                                           "a base address, not an address within the desired range.",
-                                            optional = True)]
+                                            optional = True)] + pslist.PsList.list_processes_filter_requirements
 
     @classmethod
     def protect_values(cls, context: interfaces.context.ContextInterface, virtual_layer: str,

volatility/framework/plugins/windows/vadyarascan.py

@@ -54,7 +54,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
                 default = 0x40000000,
                 description = "Set the maximum size (default is 1GB)",
                 optional = True)
-        ]
+        ] + pslist.PsList.list_processes_filter_requirements
 
     def _generator(self):