mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-30 03:39:51 +02:00
Linux PsList: Fix process list traversal
Fixes linux process listing by traversing the list backwards as well as forwards while tracking seen process offsets to avoid duplicates.
This commit is contained in:
@@ -262,17 +262,27 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
init_task = vmlinux.object_from_symbol(symbol_name="init_task")
|
||||
|
||||
# Note that the init_task itself is not yielded, since "ps" also never shows it.
|
||||
for task in init_task.tasks:
|
||||
if not task.is_valid():
|
||||
continue
|
||||
seen = set()
|
||||
for forward in (True, False):
|
||||
for task in init_task.tasks.to_list(
|
||||
symbol_type=init_task.vol.type_name,
|
||||
member="tasks",
|
||||
forward=forward,
|
||||
):
|
||||
if task.vol.offset in seen:
|
||||
continue
|
||||
seen.add(task.vol.offset)
|
||||
|
||||
if filter_func(task):
|
||||
continue
|
||||
if not task.is_valid():
|
||||
continue
|
||||
|
||||
yield task
|
||||
if filter_func(task):
|
||||
continue
|
||||
|
||||
if include_threads:
|
||||
yield from task.get_threads()
|
||||
yield task
|
||||
|
||||
if include_threads:
|
||||
yield from task.get_threads()
|
||||
|
||||
def run(self):
|
||||
pids = self.config.get("pid")
|
||||
|
||||
Reference in New Issue
Block a user