Merge pull request #563 from NiklasBeierl/doc_list_head

Doc: list_head.to_list, pslist pid 0

volatility3/framework/plugins/linux/pslist.py

@@ -78,6 +78,7 @@ class PsList(interfaces.plugins.PluginInterface):
 
         init_task = vmlinux.object_from_symbol(symbol_name = "init_task")
 
+        # Note that the init_task itself is not yielded, since "ps" also never shows it.
         for task in init_task.tasks:
             if not filter_func(task):
                 yield task

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -403,7 +403,19 @@ class list_head(objects.StructType, collections.abc.Iterable):
                 forward: bool = True,
                 sentinel: bool = True,
                 layer: Optional[str] = None) -> Iterator[interfaces.objects.ObjectInterface]:
-        """Returns an iterator of the entries in the list."""
+        """Returns an iterator of the entries in the list.
+
+        Args:
+                symbol_type: Type of the list elements
+                member: Name of the list_head member in the list elements
+                forward: Set false to go backwards
+                sentinel: Whether self is a "sentinel node", meaning it is not embedded in a member of the list
+                Sentinel nodes are NOT yielded. See https://en.wikipedia.org/wiki/Sentinel_node for further reference
+                layer: Name of layer to read from
+        Yields:
+            Objects of the type specified via the "symbol_type" argument.
+
+        """
         layer = layer or self.vol.layer_name
 
         relative_offset = self._context.symbol_space.get_type(symbol_type).relative_child_offset(member)