From a56d3468ef8fed12bb26217a7d122b1df66cfa97 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 7 Mar 2018 11:41:57 -0600 Subject: [PATCH] re-order columns --- volatility/plugins/windows/pslist.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index aeaf30a0b..94118bebb 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -35,12 +35,12 @@ class PsList(plugins.PluginInterface): memory = self.context.memory[layer_name] (_, offset, _, _) = list(memory.mapping(offset=proc.vol.offset, length=0))[0] - yield (0, (format_hints.Hex(offset), + yield (0, (proc.UniqueProcessId, + proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), - proc.UniqueProcessId, - proc.InheritedFromUniqueProcessId, + format_hints.Hex(offset), proc.ActiveThreads, proc.helper_handle_count, proc.helper_session_id, @@ -85,10 +85,10 @@ class PsList(plugins.PluginInterface): def run(self): offsettype = "(V)" if not self.config['physical'] else "(P)" - return renderers.TreeGrid([("Offset{0}".format(offsettype), format_hints.Hex), - ("ImageFileName", str), - ("PID", int), + return renderers.TreeGrid([("PID", int), ("PPID", int), + ("ImageFileName", str), + ("Offset{0}".format(offsettype), format_hints.Hex), ("Threads", int), ("Handles", int), ("SessionId", int),