diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index dcbf54351..c3fb751f4 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -28,7 +28,13 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): optional = True)] def _generator(self): - for proc in self.list_processes(): + + filter = lambda _: False + if self.config.get('pid', None): + filter = lambda x: x != self.config['pid'] + + for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], + filter = filter): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset @@ -57,18 +63,13 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (description, timeliner.TimeLinerType.CREATED, row_data[8]) yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9]) - def list_processes(self): + @classmethod + def list_processes(cls, context, layer_name, nt_symbols, filter = lambda _: False, ): """Lists all the processes in the primary layer that are in the pid config option""" - filter = lambda _: False - if self.config.get('pid', None) is not None: - filter = lambda x: x.UniqueProcessId not in [self.config['pid']] - - layer_name = self.config['primary'] - # We only use the object factory to demonstrate how to use one - kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) + kvo = context.memory[layer_name].config['kernel_virtual_offset'] + ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset)