From f139dde1217f7c3af9d9e59565c438efdfb51ce0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:53:54 -0600 Subject: [PATCH] Code Review: Fix pslist param Change to self.current_kernel_name so people can change this value. --- volatility3/cli/volshell/windows.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index cf8fd400d..c5bab3b74 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -38,7 +38,9 @@ class Volshell(generic.Volshell): def list_processes(self): """Returns a list of EPROCESS objects from the primary layer""" # We always use the main kernel memory and associated symbols - return list(pslist.PsList.list_processes(self.context, self.config["kernel"])) + return list( + pslist.PsList.list_processes(self.context, self.current_kernel_name) + ) def get_process(self, pid=None, virtaddr=None, physaddr=None): """Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed.