mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 12:47:39 +02:00
Convert the test_rig over to print process IDs (excluding the current one, and including the sentinal but that's because we're not going from the KDBG structure.
This commit is contained in:
+3
-1
@@ -127,6 +127,7 @@ def test_plugin():
|
||||
virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
|
||||
ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst)
|
||||
ntkrnlmp.set_structure_class('_ETHREAD', windows._ETHREAD)
|
||||
ntkrnlmp.set_structure_class('_LIST_ENTRY', windows._LIST_ENTRY)
|
||||
ctx.symbol_space.append(ntkrnlmp)
|
||||
|
||||
base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp')
|
||||
@@ -137,7 +138,8 @@ def test_plugin():
|
||||
import volatility.plugins.windows.pslist as pslist
|
||||
|
||||
eproc = pslist.PsList.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18)
|
||||
print(eproc.UniqueProcessId)
|
||||
for proc in eproc.ActiveProcessLinks:
|
||||
print(proc.UniqueProcessId)
|
||||
|
||||
# TODO:
|
||||
#
|
||||
|
||||
Reference in New Issue
Block a user