WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: pstree: Update to use TaskFields from pslist.get_task_fields()

Browse Source
This commit is contained in:
Gustavo Moreira
2024-12-18 16:09:36 +11:00
parent 40bdbf62da
commit f3cf182206
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/pstree.py
+11 -7
View File
@@ -13,7 +13,7 @@ class PsTree(interfaces.plugins.PluginInterface):
ID."""
_required_framework_version = (2, 13, 0)
_version = (1, 1, 0)
_version = (1, 1, 1)
@classmethod
def get_requirements(cls):
@@ -25,7 +25,7 @@ class PsTree(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -101,13 +101,17 @@ class PsTree(interfaces.plugins.PluginInterface):
def yield_processes(pid):
task = self._tasks[pid]
offset, pid, tid, ppid, name, _creation_time = (
pslist.PsList.get_task_fields(task, decorate_comm)
task_fields = pslist.PsList.get_task_fields(task, decorate_comm)
fields = (
format_hints.Hex(task_fields.offset),
task_fields.user_pid,
task_fields.user_tid,
task_fields.user_ppid,
task_fields.name,
)
fields = format_hints.Hex(offset), pid, tid, ppid, name
yield (self._levels[tid] - 1, fields)
yield (self._levels[task_fields.user_tid] - 1, fields)
for child_pid in sorted(self._children.get(tid, [])):
for child_pid in sorted(self._children.get(task_fields.user_tid, [])):
yield from yield_processes(child_pid)
for pid, level in self._levels.items():