From b8474b659e76180a69c0cef2e83d29f7317b9be8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 5 Jan 2015 00:00:56 +0000 Subject: [PATCH] Convert the test_rig over to print process IDs (excluding the current one, and including the sentinal but that's because we're not going from the KDBG structure. --- test_rig.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test_rig.py b/test_rig.py index de733553e..222e94a00 100644 --- a/test_rig.py +++ b/test_rig.py @@ -127,6 +127,7 @@ def test_plugin(): virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst) ntkrnlmp.set_structure_class('_ETHREAD', windows._ETHREAD) + ntkrnlmp.set_structure_class('_LIST_ENTRY', windows._LIST_ENTRY) ctx.symbol_space.append(ntkrnlmp) base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp') @@ -137,7 +138,8 @@ def test_plugin(): import volatility.plugins.windows.pslist as pslist eproc = pslist.PsList.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18) - print(eproc.UniqueProcessId) + for proc in eproc.ActiveProcessLinks: + print(proc.UniqueProcessId) # TODO: #