diff --git a/test_rig.py b/test_rig.py index de733553e..222e94a00 100644 --- a/test_rig.py +++ b/test_rig.py @@ -127,6 +127,7 @@ def test_plugin(): virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst) ntkrnlmp.set_structure_class('_ETHREAD', windows._ETHREAD) + ntkrnlmp.set_structure_class('_LIST_ENTRY', windows._LIST_ENTRY) ctx.symbol_space.append(ntkrnlmp) base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp') @@ -137,7 +138,8 @@ def test_plugin(): import volatility.plugins.windows.pslist as pslist eproc = pslist.PsList.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18) - print(eproc.UniqueProcessId) + for proc in eproc.ActiveProcessLinks: + print(proc.UniqueProcessId) # TODO: #