diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 90ccd4238..d29f2a2cb 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -40,9 +40,10 @@ to be able to run properly. Any that are defined as optional need not necessari requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True)] + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True)] This is a classmethod, because it is called before the specific plugin object has been instantiated (in order to know how @@ -103,11 +104,12 @@ running the plugin. :: - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True)] + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) -The final requirement is a Simple Requirement, populated by an integer. The description will be presented to the user to +The final requirement is a List Requirement, populated by integers. The description will be presented to the user to describe what the value represents. The optional flag indicates that the plugin can function without the ``pid`` value being defined within the configuration tree at all. @@ -125,7 +127,7 @@ that will be output as part of the :py:class:`~volatility.framework.interfaces.r def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 8991bb4dc..00ca475fd 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -29,6 +29,10 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True) ] def _generator(self, tasks): @@ -80,7 +84,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command())) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], @@ -91,7 +95,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): filter_func = filter_func))) def generate_timeline(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for row in self._generator( pslist.PsList.list_tasks(self.context, diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index 3cf6bc352..55627ee79 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -24,7 +24,11 @@ class Elfs(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks): @@ -47,7 +51,7 @@ class Elfs(plugins.PluginInterface): yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("File Path", str)], diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index 98feb7364..68e275b05 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -26,7 +26,11 @@ class Lsof(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks): @@ -45,7 +49,7 @@ class Lsof(plugins.PluginInterface): yield (0, (pid, name, fd_num, full_path)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)], self._generator( diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index e8f2710f7..f3952bc77 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -23,6 +23,10 @@ class Malfind(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _list_injections(self, task): @@ -62,7 +66,7 @@ class Malfind(interfaces.plugins.PluginInterface): vma.get_protection(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index 77ce5f19f..d9d5c611e 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -23,7 +23,11 @@ class Maps(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks): @@ -54,7 +58,7 @@ class Maps(plugins.PluginInterface): format_hints.Hex(page_offset), major, minor, inode, path)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str), diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 455b24394..9848cf192 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -21,10 +21,10 @@ class PsList(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.IntRequirement(name = 'pid', - description = 'Filter on a specific process ID', - default = None, - optional = True) + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] @classmethod @@ -53,7 +53,7 @@ class PsList(interfaces.plugins.PluginInterface): for task in self.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], - filter_func = self.create_pid_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter(self.config.get('pid', None))): pid = task.pid ppid = 0 if task.parent: diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 171921513..47362522d 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -27,7 +27,12 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) + ] def _generator(self, tasks): @@ -83,7 +88,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command())) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), @@ -95,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): filter_func = filter_func))) def generate_timeline(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) for row in self._generator( diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 6c2176f97..2737cd7c1 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -23,7 +23,11 @@ class Lsof(plugins.PluginInterface): description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks): @@ -36,7 +40,7 @@ class Lsof(plugins.PluginInterface): yield (0, (pid, fd, filepath)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)], diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index 44370d313..927fdbca6 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -22,6 +22,11 @@ class Malfind(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) + ] def _list_injections(self, task): @@ -61,7 +66,7 @@ class Malfind(interfaces.plugins.PluginInterface): vma.get_perms(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 885ac7d19..3554f2d2c 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -26,7 +26,12 @@ class Netstat(plugins.PluginInterface): description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) + ] @classmethod @@ -45,7 +50,7 @@ class Netstat(plugins.PluginInterface): 2) The process ID of the processed that opened the socket 3) The address of the associated socket structure """ - # This is hardcoded, since a change in method + # This is hardcoded, since a change in the default method would change the expected results list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0]) for task in list_tasks(context, layer_name, darwin_symbols, filter_func): @@ -69,7 +74,7 @@ class Netstat(plugins.PluginInterface): yield task_name, pid, socket def _generator(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for task_name, pid, socket in self.list_sockets(self.context, self.config['primary'], diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility/framework/plugins/mac/proc_maps.py index faeb70c15..7f937567a 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility/framework/plugins/mac/proc_maps.py @@ -19,7 +19,11 @@ class Maps(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks): @@ -36,7 +40,7 @@ class Maps(interfaces.plugins.PluginInterface): format_hints.Hex(vma.links.end), vma.get_perms(), path)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index cc984b9e5..048ea6d4b 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -21,7 +21,11 @@ class Psaux(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]: @@ -86,7 +90,7 @@ class Psaux(plugins.PluginInterface): yield (0, (task.p_pid, task_name, task.p_argc, args_str)) def run(self) -> renderers.TreeGrid: - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 0f9bab9e9..e99c20e31 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -6,6 +6,7 @@ import logging from typing import Callable, Iterable, List, Dict from volatility.framework import renderers, interfaces, contexts, exceptions +from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -29,7 +30,11 @@ class PsList(interfaces.plugins.PluginInterface): description = 'Method to determine for processes', choices = cls.pslist_methods, default = cls.pslist_methods[0], - optional = True) + optional = True), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True) ] @classmethod @@ -82,7 +87,7 @@ class PsList(interfaces.plugins.PluginInterface): for task in list_tasks(self.context, self.config['primary'], self.config['darwin'], - filter_func = self.create_pid_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter(self.config.get('pid', None))): pid = task.p_pid ppid = task.p_ppid name = utility.array_to_string(task.p_comm) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 932140680..5ea83172a 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -24,9 +24,10 @@ class CmdLine(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True) + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True) ] def _generator(self, procs): @@ -62,7 +63,7 @@ class CmdLine(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)], self._generator( diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 71c5277e3..1fd6e3b88 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -33,9 +33,10 @@ class DllDump(interfaces.plugins.PluginInterface): "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] @@ -104,7 +105,7 @@ class DllDump(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 099be360d..96dc089e6 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -22,9 +22,10 @@ class DllList(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True) + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True) ] def _generator(self, procs): @@ -48,7 +49,7 @@ class DllList(interfaces.plugins.PluginInterface): format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str)], diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index f504eb98c..6ed8eeaee 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -41,9 +41,10 @@ class Handles(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] @@ -333,7 +334,7 @@ class Handles(interfaces.plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("HandleValue", format_hints.Hex), ("Type", str), diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 423cc6f66..16927a60e 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -25,9 +25,10 @@ class Malfind(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] @@ -132,7 +133,7 @@ class Malfind(interfaces.plugins.PluginInterface): vad.get_commit_charge(), vad.get_private_memory(), format_hints.HexBytes(data), disasm)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str), diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 666592b64..2017fe57e 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -28,9 +28,10 @@ class ProcDump(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] @@ -97,7 +98,7 @@ class ProcDump(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 255730fab..cd8198e52 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -30,9 +30,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description = 'Display physical offsets instead of virtual', default = cls.PHYSICAL_DEFAULT, optional = True), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True) + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process ID to include (all other processes are excluded)", + optional = True) ] @classmethod @@ -127,7 +128,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], - filter_func = self.create_pid_filter([self.config.get('pid', None)])): + filter_func = self.create_pid_filter(self.config.get('pid', None))): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 070b10752..e4be655fb 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -30,9 +30,10 @@ class VadDump(interfaces.plugins.PluginInterface): "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] @@ -94,7 +95,7 @@ class VadDump(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], self._generator( diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 2608026de..454d2630f 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -52,9 +52,10 @@ class VadInfo(interfaces.plugins.PluginInterface): "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True), + requirements.ListRequirement(name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] @@ -121,7 +122,7 @@ class VadInfo(interfaces.plugins.PluginInterface): def run(self): - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 922788132..abff191f8 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -45,9 +45,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface): optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'yarascan', plugin = yarascan.YaraScan, version = (2, 0, 0)), - requirements.IntRequirement(name = 'pid', - description = "Process ID to include (all other processes are excluded)", - optional = True) + requirements.ListRequirement(name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True) ] def _generator(self): @@ -68,7 +69,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for task in pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'],