diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 434eb3b63..d1ed0c062 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -37,7 +37,7 @@ class CmdLine(interfaces_plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + ] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index cb25b796f..4dea2cd37 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -22,10 +22,11 @@ import logging import ntpath from typing import List -import volatility.framework.constants as constants -import volatility.framework.interfaces.plugins as interfaces_plugins import volatility.plugins.windows.pslist as pslist import volatility.plugins.windows.vadinfo as vadinfo + +import volatility.framework.constants as constants +import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import interfaces from volatility.framework import renderers from volatility.framework.configuration import requirements @@ -50,7 +51,7 @@ class DllDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + optional = True)] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 5c698feb9..1af1128f7 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -37,7 +37,7 @@ class DllList(interfaces_plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + ] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 3827e7b6e..eacb703d1 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -56,7 +56,7 @@ class Handles(interfaces_plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + ] + pslist.PsList.list_processes_filter_requirements def _decode_pointer(self, value, magic): """Windows encodes pointers to objects and decodes them on the fly diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 60a7bf2b5..0a780ebd3 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -20,6 +20,7 @@ import volatility.plugins.windows.pslist as pslist import volatility.plugins.windows.vadinfo as vadinfo + from volatility.framework import interfaces, symbols from volatility.framework import renderers from volatility.framework.configuration import requirements @@ -37,7 +38,7 @@ class Malfind(interfaces.plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + ] + pslist.PsList.list_processes_filter_requirements @classmethod def is_vad_empty(self, proc_layer, vad): diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 38966f1b4..4bffb2d35 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -44,7 +44,7 @@ class ProcDump(interfaces_plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + ] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 3c75a7303..013bde32a 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -40,15 +40,17 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of pids - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True), requirements.BooleanRequirement( name = 'physical', description = 'Display physical offsets instead of virtual', default = cls.PHYSICAL_DEFAULT, optional = True) - ] + ] + cls.list_processes_filter_requirements + + list_processes_filter_requirements = [ + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] @classmethod def create_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 45d6658ca..bb3ba6b3a 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -47,7 +47,7 @@ class VadDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + optional = True)] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 3c59d0e18..2a3479f29 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -66,7 +66,7 @@ class VadInfo(interfaces.plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + optional = True)] + pslist.PsList.list_processes_filter_requirements @classmethod def protect_values(cls, context: interfaces.context.ContextInterface, virtual_layer: str, diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index ce969b910..e2090f562 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -54,7 +54,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): default = 0x40000000, description = "Set the maximum size (default is 1GB)", optional = True) - ] + ] + pslist.PsList.list_processes_filter_requirements def _generator(self):