From bef1a0f654ee2ce66246dda71b440cca2043673e Mon Sep 17 00:00:00 2001 From: Niklas Beierl Date: Wed, 8 Sep 2021 12:04:28 +0200 Subject: [PATCH] Doc: list_head.to_list, pslist pid 0 Added Documentation for the params of list_head.to_list Added a comment to linux.pslist explaining why the init task is not yielded. --- volatility3/framework/plugins/linux/pslist.py | 1 + .../framework/symbols/linux/extensions/__init__.py | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index ed7374f2f..9b97a56d1 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -78,6 +78,7 @@ class PsList(interfaces.plugins.PluginInterface): init_task = vmlinux.object_from_symbol(symbol_name = "init_task") + # Note that the init_task itself is not yielded, since "ps" also never shows it. for task in init_task.tasks: if not filter_func(task): yield task diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7b14a8674..fbc02399f 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -403,7 +403,19 @@ class list_head(objects.StructType, collections.abc.Iterable): forward: bool = True, sentinel: bool = True, layer: Optional[str] = None) -> Iterator[interfaces.objects.ObjectInterface]: - """Returns an iterator of the entries in the list.""" + """Returns an iterator of the entries in the list. + + Args: + symbol_type: Type of the list elements + member: Name of the list_head member in the list elements + forward: Set false to go backwards + sentinel: Whether self is a "sentinel node", meaning it is not embedded in a member of the list + Sentinel nodes are NOT yielded. See https://en.wikipedia.org/wiki/Sentinel_node for further reference + layer: Name of layer to read from + Yields: + Objects of the type specified via the "symbol_type" argument. + + """ layer = layer or self.vol.layer_name relative_offset = self._context.symbol_space.get_type(symbol_type).relative_child_offset(member)