Update test_rig code to play around with code fragments.

test_rig.py

@@ -120,8 +120,11 @@ def test_plugin():
     nativelst = native.x86NativeTable
     ctx = framework.Context(nativelst)
 
+    import volatility.framework.symbols.windows as windows
+
     virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
     ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst)
+    ntkrnlmp.set_structure_class('_ETHREAD', windows._ETHREAD)
     ctx.symbol_space.append(ntkrnlmp)
 
     base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp')
@@ -131,7 +134,8 @@ def test_plugin():
 
     import volatility.plugins.windows.pslist as pslist
 
-    x = pslist.pslist.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18)
+    eproc = pslist.pslist.kernel_process_from_physical_process(ctx, 'data', 'intel', 0x192ad18)
+    print(eproc.UniqueProcessId)
 
 # TODO:
 #

volatility/framework/symbols/windows/__init__.py

@@ -0,0 +1,9 @@
+__author__ = 'mike'
+
+import volatility.framework.objects as objects
+
+
+class _ETHREAD(objects.Struct):
+    def owning_process(self, kernel_layer):
+        """Return the EPROCESS that owns this thread"""
+        return self.ThreadsProcess.dereference(kernel_layer)

volatility/plugins/windows/pslist.py

@@ -11,16 +11,18 @@ class pslist(plugins.PluginInterface):
 
     @staticmethod
     def kernel_process_from_physical_process(ctx, physical_layer, kernel_layer, offset):
-        kernel = ctx.memory[kernel_layer]
+        """Return a kernel process object from physical process data."""
+        # Get the process in the physical space
         flateproc = ctx.object("ntkrnlmp!_EPROCESS", physical_layer, offset = offset)
-        print(flateproc.ThreadListHead.Flink)
+        # Determine the relative offset from the Thread head to the ThreadListEntry
         reloff = ctx.symbol_space.get_structure("ntkrnlmp!_ETHREAD").relative_child_offset("ThreadListEntry")
-        eproc = ctx.object("ntkrnlmp!_EPROCESS", kernel_layer, offset = flateproc.ThreadListHead.Flink - reloff)
-        print("".join(eproc.ImageFileName))
+        # Get the thread object in kernel space from the
+        ethread = ctx.object("ntkrnlmp!_ETHREAD", kernel_layer, offset = flateproc.ThreadListHead.Flink - reloff)
+        # Get the process from the thread object in kernel space
+        return ethread.owning_process()
 
     def __call__(self, ctx, **kwargs):
-        print("PSList called")
-        self.kernel_process_from_physical_process(ctx, 'intel', 0x192ad18)
+        print(repr(self.kernel_process_from_physical_process(ctx, 'intel', 0x192ad18)))
 
 
 if __name__ == '__main__':