From f197b433466e38d85910d5e22ea458ff76fffc48 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 16 Jan 2016 22:02:20 +0000
Subject: [PATCH] Tidy up the requirements and fudge the code to use only the
 virtual address space for now.

---
 volatility/plugins/windows/pslist.py | 38 +++++++++++++++-------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py
index b6f5cb51c..899dd6656 100644
--- a/volatility/plugins/windows/pslist.py
+++ b/volatility/plugins/windows/pslist.py
@@ -1,26 +1,24 @@
-import volatility.framework.configuration.requirements
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import configuration
+from volatility.framework.configuration import requirements
 
 
 class PsList(plugins.PluginInterface):
     @classmethod
     def get_schema(cls):
-        return [volatility.framework.configuration.requirements.TranslationLayerRequirement(name = 'primary',
-                                                                                            description = 'Kernel Address Space',
-                                                                                            constraints = {"type": "memory",
-                                                                         "architecture": ["ia32", "pae"]}),
-                volatility.framework.configuration.requirements.SymbolRequirement(name = "ntkrnlmp",
-                                                                                  description = "Windows OS",
-                                                                                  constraints = {"type": "symbols",
-                                                               "os": "windows",
-                                                               "architecture": ["ia32", "pae"]}),
-                volatility.framework.configuration.requirements.IntRequirement(name = 'pid',
-                                                                               description = "Process ID",
-                                                                               optional = True),
-                volatility.framework.configuration.requirements.IntRequirement(name = 'offset',
-                                                                               description = 'Address of any process',
-                                                                               default = 0x192ad18)]
+        return [requirements.TranslationLayerRequirement(name = 'primary',
+                                                         description = 'Kernel Address Space',
+                                                         constraints = {"type": "memory",
+                                                                        "architecture": ["ia32", "pae"]}),
+                requirements.SymbolRequirement(name = "ntkrnlmp",
+                                               description = "Windows OS",
+                                               constraints = {"type": "symbols",
+                                                              "os": "windows",
+                                                              "architecture": ["ia32", "pae"]}),
+                requirements.IntRequirement(name = 'pid',
+                                            description = "Process ID",
+                                            optional = True),
+                requirements.IntRequirement(name = 'offset',
+                                            description = 'Virtual address of any process')]
 
     @staticmethod
     def kernel_process_from_physical_process(ctx, physical_layer, kernel_layer, offset):
@@ -35,7 +33,11 @@ class PsList(plugins.PluginInterface):
         return ethread.owning_process()
 
     def run(self):
-        eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel',
+
+        # Use the primary twice until we figure out how to specify base layers of a particular translation layer
+        eproc = self.kernel_process_from_physical_process(self.context,
+                                                          self.config['primary'],
+                                                          self.config['primary'],
                                                           self.config['offset'])
         for proc in eproc.ActiveProcessLinks:
             print(proc.UniqueProcessId)