Convert the test_rig over to print process IDs (excluding the current one, and including the sentinal but that's because we're not going from the KDBG structure.

This commit is contained in:
Mike Auty
2015-01-05 00:00:56 +00:00
parent 7c53ae31bb
commit b8474b659e
+3 -1
View File
@@ -127,6 +127,7 @@ def test_plugin():
virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst)
ntkrnlmp.set_structure_class('_ETHREAD', windows._ETHREAD)
ntkrnlmp.set_structure_class('_LIST_ENTRY', windows._LIST_ENTRY)
ctx.symbol_space.append(ntkrnlmp)
base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp')
@@ -137,7 +138,8 @@ def test_plugin():
import volatility.plugins.windows.pslist as pslist
eproc = pslist.PsList.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18)
print(eproc.UniqueProcessId)
for proc in eproc.ActiveProcessLinks:
print(proc.UniqueProcessId)
# TODO:
#