From ac8401991cb1104bc548042ce94a9bcf0e4da8d9 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Fri, 15 Jun 2018 23:40:54 +0100
Subject: [PATCH] Convert all remaining plugins to use the new classmethod
 pslist.

---
 volatility/framework/layers/registry.py |  9 ++++-----
 volatility/plugins/linux/proc.py        |  6 +++---
 volatility/plugins/linux/pslist.py      |  9 +++++----
 volatility/plugins/windows/dlldump.py   | 17 +++++++++++------
 volatility/plugins/windows/dlllist.py   |  7 +++++--
 volatility/plugins/windows/handles.py   |  7 +++++--
 volatility/plugins/windows/malfind.py   |  4 +++-
 volatility/plugins/windows/moddump.py   | 24 ++++++++++++++----------
 volatility/plugins/windows/procdump.py  | 23 ++++++++++++++---------
 volatility/plugins/windows/pslist.py    | 18 ++++++++++++------
 volatility/plugins/windows/strings.py   |  6 +++---
 volatility/plugins/windows/vaddump.py   |  7 +++++--
 volatility/plugins/windows/vadinfo.py   |  7 +++++--
 13 files changed, 89 insertions(+), 55 deletions(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index 0c6be6bae..b3eb0fb7e 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -47,11 +47,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
 
         # Win10 17063 introduced the Registry process to map most hives.  Check
         # if it exists and update RegistryHive._base_layer
-        pslist_config_path = self.make_subconfig(primary=self.config['base_layer'],
-                                                 nt_symbols=self.config['nt_symbols'])
-        plugin = pslist.PsList(self.context, pslist_config_path)
-        for proc in plugin.list_processes():
-            proc_name = proc.ImageFileName.cast("string", max_length=proc.ImageFileName.vol.count,
+        for proc in pslist.PsList.list_processes(self.context,
+                                                 self.config['base_layer'],
+                                                 self.config['nt_symbols']):
+            proc_name = proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
                                                 errors = 'replace')
             if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4:
                 proc_layer_name = proc.add_process_layer()
diff --git a/volatility/plugins/linux/proc.py b/volatility/plugins/linux/proc.py
index f31a29a77..daa9ac799 100644
--- a/volatility/plugins/linux/proc.py
+++ b/volatility/plugins/linux/proc.py
@@ -54,8 +54,6 @@ class Maps(plugins.PluginInterface):
                      ))
 
     def run(self):
-        plugin = pslist.PsList(self.context, self.config_path)
-
         return renderers.TreeGrid(
             [("PID", int),
              ("Process", str),
@@ -67,4 +65,6 @@ class Maps(plugins.PluginInterface):
              ("Minor", int),
              ("Inode", int),
              ("File Path", str)],
-            self._generator(plugin.list_tasks()))
+            self._generator(pslist.PsList.list_tasks(self.context,
+                                                     self.config['primary'],
+                                                     self.config['vmlinux'])))
diff --git a/volatility/plugins/linux/pslist.py b/volatility/plugins/linux/pslist.py
index 59e0f9b0c..75baf3830 100644
--- a/volatility/plugins/linux/pslist.py
+++ b/volatility/plugins/linux/pslist.py
@@ -25,13 +25,14 @@ class PsList(interfaces_plugins.PluginInterface):
             name = utility.array_to_string(task.comm)
             yield (0, (pid, ppid, name))
 
-    def list_tasks(self):
+    @classmethod
+    def list_tasks(cls, context, primary_layer: str, vmlinux_table: str):
         """Lists all the tasks in the primary layer"""
 
-        layer_name = self.context.memory[self.config['primary']].config['memory_layer']
+        layer_name = context.memory[primary_layer].config['memory_layer']
 
-        _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config["vmlinux"], layer_name)
-        vmlinux = self.context.module(self.config["vmlinux"], self.config["primary"], aslr_shift)
+        _, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_table, layer_name)
+        vmlinux = context.module(vmlinux_table, primary_layer, aslr_shift)
         init_task = vmlinux.object(symbol_name = "init_task")
 
         for task in init_task.tasks:
diff --git a/volatility/plugins/windows/dlldump.py b/volatility/plugins/windows/dlldump.py
index a290b29fa..e43ee8bbb 100644
--- a/volatility/plugins/windows/dlldump.py
+++ b/volatility/plugins/windows/dlldump.py
@@ -1,16 +1,18 @@
-import logging, ntpath
+import logging
+import ntpath
 
+import volatility.framework.constants as constants
 import volatility.framework.interfaces.plugins as interfaces_plugins
 import volatility.plugins.windows.pslist as pslist
 import volatility.plugins.windows.vadinfo as vadinfo
 from volatility.framework import interfaces
 from volatility.framework import renderers
 from volatility.framework.objects import utility
-import volatility.framework.constants as constants
 from volatility.framework.symbols.windows.pe import PEIntermedSymbols
 
 vollog = logging.getLogger(__name__)
 
+
 class DllDump(interfaces_plugins.PluginInterface):
     """Dumps process memory ranges as DLLs"""
 
@@ -59,8 +61,8 @@ class DllDump(interfaces_plugins.PluginInterface):
                                                         vad.get_start()))
 
                     dos_header = self.context.object(pe_table_name + constants.BANG +
-                                                     "_IMAGE_DOS_HEADER", offset=vad.get_start(),
-                                                     layer_name=proc_layer_name)
+                                                     "_IMAGE_DOS_HEADER", offset = vad.get_start(),
+                                                     layer_name = proc_layer_name)
 
                     for offset, data in dos_header.reconstruct():
                         filedata.data.seek(offset)
@@ -76,9 +78,12 @@ class DllDump(interfaces_plugins.PluginInterface):
                            result_text))
 
     def run(self):
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
                                    ("Result", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/dlllist.py b/volatility/plugins/windows/dlllist.py
index 7caa740f1..017e08c04 100644
--- a/volatility/plugins/windows/dlllist.py
+++ b/volatility/plugins/windows/dlllist.py
@@ -34,7 +34,7 @@ class DllList(interfaces_plugins.PluginInterface):
 
     def run(self):
 
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
@@ -42,4 +42,7 @@ class DllList(interfaces_plugins.PluginInterface):
                                    ("Size", format_hints.Hex),
                                    ("Name", str),
                                    ("Path", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/handles.py b/volatility/plugins/windows/handles.py
index dd7eeb716..8411ffcf0 100644
--- a/volatility/plugins/windows/handles.py
+++ b/volatility/plugins/windows/handles.py
@@ -304,7 +304,7 @@ class Handles(interfaces_plugins.PluginInterface):
 
     def run(self):
 
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
@@ -312,4 +312,7 @@ class Handles(interfaces_plugins.PluginInterface):
                                    ("Type", str),
                                    ("GrantedAccess", format_hints.Hex),
                                    ("Name", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/malfind.py b/volatility/plugins/windows/malfind.py
index a828761ed..5c9ef1c3a 100644
--- a/volatility/plugins/windows/malfind.py
+++ b/volatility/plugins/windows/malfind.py
@@ -103,6 +103,7 @@ class Malfind(interfaces_plugins.PluginInterface):
                            disasm))
 
     def run(self):
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
@@ -116,4 +117,5 @@ class Malfind(interfaces_plugins.PluginInterface):
                                    ("Disasm", interfaces_renderers.Disassembly)],
                                   self._generator(pslist.PsList.list_processes(self.context,
                                                                                self.config['primary'],
-                                                                               self.config['nt_symbols'])))
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/moddump.py b/volatility/plugins/windows/moddump.py
index 5162a835f..d7b9c9d97 100644
--- a/volatility/plugins/windows/moddump.py
+++ b/volatility/plugins/windows/moddump.py
@@ -1,15 +1,17 @@
 import logging
-import volatility.framework.interfaces.plugins as interfaces_plugins
-import volatility.plugins.windows.modules as modules
-import volatility.plugins.windows.pslist as pslist
-import volatility.framework.renderers as renderers
+
 import volatility.framework.constants as constants
 import volatility.framework.exceptions as exceptions
+import volatility.framework.interfaces.plugins as interfaces_plugins
+import volatility.framework.renderers as renderers
+import volatility.plugins.windows.modules as modules
+import volatility.plugins.windows.pslist as pslist
 from volatility.framework.renderers import format_hints
 from volatility.framework.symbols.windows.pe import PEIntermedSymbols
 
 vollog = logging.getLogger(__name__)
 
+
 class ModDump(interfaces_plugins.PluginInterface):
     """Dumps kernel modules"""
 
@@ -31,17 +33,19 @@ class ModDump(interfaces_plugins.PluginInterface):
         layers = [layer_name]
 
         seen_ids = []
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
-        for proc in plugin.list_processes():
+        for proc in pslist.PsList.list_processes(self.context,
+                                                 self.config['primary'],
+                                                 self.config['nt_symbols']):
             proc_layer_name = proc.add_process_layer()
 
             try:
                 # create the session space object in the process' own layer.
                 # not all processes have a valid session pointer.
                 session_space = self.context.object(self.config["nt_symbols"] + constants.BANG + "_MM_SESSION_SPACE",
-                                                    layer_name=layer_name,
-                                                    offset=proc.Session)
+                                                    layer_name = layer_name,
+                                                    offset = proc.Session)
 
                 if session_space.SessionId in seen_ids:
                     continue
@@ -93,8 +97,8 @@ class ModDump(interfaces_plugins.PluginInterface):
             else:
                 try:
                     dos_header = self.context.object(pe_table_name + constants.BANG +
-                                                     "_IMAGE_DOS_HEADER", offset=mod.DllBase,
-                                                     layer_name=session_layer_name)
+                                                     "_IMAGE_DOS_HEADER", offset = mod.DllBase,
+                                                     layer_name = session_layer_name)
 
                     filedata = interfaces_plugins.FileInterface(
                         "module.{0:#x}.dmp".format(mod.DllBase))
diff --git a/volatility/plugins/windows/procdump.py b/volatility/plugins/windows/procdump.py
index 314317acf..dc513bfbe 100644
--- a/volatility/plugins/windows/procdump.py
+++ b/volatility/plugins/windows/procdump.py
@@ -1,14 +1,16 @@
 import logging
-import volatility.framework.interfaces.plugins as interfaces_plugins
-import volatility.plugins.windows.pslist as pslist
-import volatility.framework.renderers as renderers
+
 import volatility.framework.constants as constants
 import volatility.framework.exceptions as exceptions
+import volatility.framework.interfaces.plugins as interfaces_plugins
+import volatility.framework.renderers as renderers
+import volatility.plugins.windows.pslist as pslist
 from volatility.framework.objects import utility
 from volatility.framework.symbols.windows.pe import PEIntermedSymbols
 
 vollog = logging.getLogger(__name__)
 
+
 class ProcDump(interfaces_plugins.PluginInterface):
     """Dumps process executable images"""
 
@@ -31,12 +33,12 @@ class ProcDump(interfaces_plugins.PluginInterface):
 
             try:
                 peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB",
-                                           layer_name=proc_layer_name,
-                                           offset=proc.Peb)
+                                           layer_name = proc_layer_name,
+                                           offset = proc.Peb)
 
                 dos_header = self.context.object(pe_table_name + constants.BANG +
-                                                 "_IMAGE_DOS_HEADER", offset=peb.ImageBaseAddress,
-                                                 layer_name=proc_layer_name)
+                                                 "_IMAGE_DOS_HEADER", offset = peb.ImageBaseAddress,
+                                                 layer_name = proc_layer_name)
 
                 filedata = interfaces_plugins.FileInterface(
                     "pid.{0}.{1:#x}.dmp".format(proc.UniqueProcessId, peb.ImageBaseAddress))
@@ -62,9 +64,12 @@ class ProcDump(interfaces_plugins.PluginInterface):
                        result_text))
 
     def run(self):
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
                                    ("Result", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py
index c3fb751f4..95b7fcd6b 100644
--- a/volatility/plugins/windows/pslist.py
+++ b/volatility/plugins/windows/pslist.py
@@ -1,4 +1,5 @@
 import datetime
+import typing
 
 import volatility.framework.interfaces.plugins as plugins
 from volatility.framework import renderers
@@ -27,14 +28,19 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
                                                 default = cls.PHYSICAL_DEFAULT,
                                                 optional = True)]
 
+    @classmethod
+    def create_filter(cls, pid_list: typing.List[int] = None):
+        filter = lambda _: False
+        if [x for x in pid_list if x is not None]:
+            filter = lambda x: x not in pid_list
+        return filter
+
     def _generator(self):
 
-        filter = lambda _: False
-        if self.config.get('pid', None):
-            filter = lambda x: x != self.config['pid']
-
-        for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'],
-                                        filter = filter):
+        for proc in self.list_processes(self.context,
+                                        self.config['primary'],
+                                        self.config['nt_symbols'],
+                                        filter = self.create_filter([self.config.get('pid', None)])):
 
             if not self.config.get('physical', self.PHYSICAL_DEFAULT):
                 offset = proc.vol.offset
diff --git a/volatility/plugins/windows/strings.py b/volatility/plugins/windows/strings.py
index f24ce5424..dd87c991c 100644
--- a/volatility/plugins/windows/strings.py
+++ b/volatility/plugins/windows/strings.py
@@ -72,9 +72,9 @@ class Strings(interfaces.plugins.PluginInterface):
 
             # TODO: Include kernel modules
 
-            plugin = pslist.PsList(self.context, self.config_path)
-
-            for process in plugin.list_processes():
+            for process in pslist.PsList.list_processes(self.context,
+                                                        self.config['primary'],
+                                                        self.config['nt_symbols']):
                 proc_layer_name = process.add_process_layer()
                 proc_layer = self.context.memory[proc_layer_name]
                 if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface):
diff --git a/volatility/plugins/windows/vaddump.py b/volatility/plugins/windows/vaddump.py
index e19a083b0..872cbff56 100644
--- a/volatility/plugins/windows/vaddump.py
+++ b/volatility/plugins/windows/vaddump.py
@@ -56,9 +56,12 @@ class VadDump(interfaces_plugins.PluginInterface):
                            result_text))
 
     def run(self):
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
                                    ("Result", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))
diff --git a/volatility/plugins/windows/vadinfo.py b/volatility/plugins/windows/vadinfo.py
index d35ca6caf..15610556b 100644
--- a/volatility/plugins/windows/vadinfo.py
+++ b/volatility/plugins/windows/vadinfo.py
@@ -91,7 +91,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
 
     def run(self):
 
-        plugin = pslist.PsList(self.context, self.config_path)
+        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         return renderers.TreeGrid([("PID", int),
                                    ("Process", str),
@@ -104,4 +104,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
                                    ("PrivateMemory", int),
                                    ("Parent", format_hints.Hex),
                                    ("File", str)],
-                                  self._generator(plugin.list_processes()))
+                                  self._generator(pslist.PsList.list_processes(self.context,
+                                                                               self.config['primary'],
+                                                                               self.config['nt_symbols'],
+                                                                               filter = filter)))