WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Code Review: Fix pslist param

Browse Source 
Change to self.current_kernel_name so people can change this value.
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
parent cad15d0c92
commit f139dde121
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/cli/volshell/windows.py
+3 -1
View File
@@ -38,7 +38,9 @@ class Volshell(generic.Volshell):
def list_processes(self):
"""Returns a list of EPROCESS objects from the primary layer"""
# We always use the main kernel memory and associated symbols
return list(pslist.PsList.list_processes(self.context, self.config["kernel"]))
return list(
pslist.PsList.list_processes(self.context, self.current_kernel_name)
)
def get_process(self, pid=None, virtaddr=None, physaddr=None):
"""Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed.