From 8e12cf02e3720c3c58df6a3fb66930278d797b38 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 18 Dec 2024 15:56:55 +1100
Subject: [PATCH] linux: psscan: reimplemented to make use of
 pslist.get_task_fields()

---
 volatility3/framework/plugins/linux/psscan.py | 49 +++++++------------
 1 file changed, 18 insertions(+), 31 deletions(-)

diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py
index c93f06088..ba68c4856 100644
--- a/volatility3/framework/plugins/linux/psscan.py
+++ b/volatility3/framework/plugins/linux/psscan.py
@@ -2,15 +2,15 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import Iterable, List, Tuple
+from typing import Iterable, List
 import struct
 from enum import Enum
 
 from volatility3.framework import renderers, interfaces, symbols, constants, exceptions
 from volatility3.framework.configuration import requirements
-from volatility3.framework.objects import utility
 from volatility3.framework.layers import scanners
 from volatility3.framework.renderers import format_hints
+from volatility3.plugins.linux import pslist
 
 vollog = logging.getLogger(__name__)
 
@@ -28,7 +28,7 @@ class PsScan(interfaces.plugins.PluginInterface):
     """Scans for processes present in a particular linux image."""
 
     _required_framework_version = (2, 13, 0)
-    _version = (1, 1, 0)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -38,34 +38,11 @@ class PsScan(interfaces.plugins.PluginInterface):
                 description="Linux kernel",
                 architectures=["Intel32", "Intel64"],
             ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
+            ),
         ]
 
-    def _get_task_fields(
-        self, task: interfaces.objects.ObjectInterface
-    ) -> Tuple[int, int, int, str, str]:
-        """Extract the fields needed for the final output
-
-        Args:
-            task: A task object from where to get the fields.
-        Returns:
-            A tuple with the fields to show in the plugin output.
-        """
-        pid = task.tgid
-        tid = task.pid
-        ppid = task.get_parent_pid()
-        name = utility.array_to_string(task.comm)
-        exit_state = DescExitStateEnum(task.exit_state).name
-
-        task_fields = (
-            format_hints.Hex(task.vol.offset),
-            pid,
-            tid,
-            ppid,
-            name,
-            exit_state,
-        )
-        return task_fields
-
     def _generator(self):
         """Generates the tasks found from scanning."""
 
@@ -75,8 +52,18 @@ class PsScan(interfaces.plugins.PluginInterface):
         for task in self.scan_tasks(
             self.context, vmlinux_module_name, vmlinux.layer_name
         ):
-            row = self._get_task_fields(task)
-            yield (0, row)
+            task_fields = pslist.PsList.get_task_fields(task)
+            exit_state = DescExitStateEnum(task.exit_state).name
+            fields = (
+                format_hints.Hex(task_fields.offset),
+                task_fields.user_pid,
+                task_fields.user_tid,
+                task_fields.user_ppid,
+                task_fields.name,
+                exit_state,
+            )
+
+            yield (0, fields)
 
     @classmethod
     def scan_tasks(