Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more process information to mac.pslist plugin #952

Merged
merged 4 commits into from
Jul 12, 2023

Conversation

cpuu
Copy link
Contributor

@cpuu cpuu commented May 10, 2023

Enhance the macOS PsList plugin by including additional process information such as offset, UID, GID, and start time in the output. Update the TreeGrid columns to display the new information.
(I have arranged the output format and order of this plugin to be in line with the existing Volatility2.)

Before

$ python3 vol.py -f ../contact_me mac.pslist.PsList
Volatility 3 Framework 2.4.2
Progress:  100.00               Stacking attempts finished
PID     PPID    COMM

0       0       kernel_task
1       0       launchd
35      1       UserEventAgent
38      1       kextd
39      1       fseventsd
37      1       uninstalld
45      1       configd
46      1       powerd
52      1       logd

After

$ python3 vol.py -f ../contact_me mac.pslist.PsList
Volatility 3 Framework 2.4.2
Progress:  100.00               Stacking attempts finished
OFFSET          NAME            PID     UID     GID     Start Time                      PPID

0xff80128bb460  kernel_task     0       0       0       2019-03-23 22:06:41.934667      0
0xff801775b838  launchd         1       0       0       2019-03-23 22:06:41.934999      0
0xff801775af48  UserEventAgent  35      0       0       2019-03-23 22:06:47.314708      1
0xff801775b3c0  kextd           38      0       0       2019-03-23 22:06:47.444847      1
0xff801775c128  fseventsd       39      0       0       2019-03-23 22:06:47.446987      1
0xff801775bcb0  uninstalld      37      0       0       2019-03-23 22:06:47.444385      1
0xff801775ce90  configd         45      0       0       2019-03-23 22:06:47.457690      1
0xff801775d308  powerd          46      0       0       2019-03-23 22:06:47.459493      1
0xff801775e4e8  logd            52      0       0       2019-03-23 22:06:47.469908      1

cpuu added 2 commits May 10, 2023 09:49
Enhance the PsList plugin by including additional process information such as offset, UID, GID, and start time in the output. Update the TreeGrid columns to display the new information.
Applied the Black Python linter to the mac PsList plugin, resulting in more readable and consistent code formatting.
Copy link
Contributor

@digitalisx digitalisx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All right, I left a few comments on this change.
I don't know if the maintainer will agree with my review, but it would be good to think about it.

volatility3/framework/plugins/mac/pslist.py Show resolved Hide resolved
volatility3/framework/plugins/mac/pslist.py Outdated Show resolved Hide resolved
@ikelos
Copy link
Member

ikelos commented Jul 5, 2023

@cpuu please could you review the open comments on this bug so we can move ahead with merging your code?

@cpuu
Copy link
Contributor Author

cpuu commented Jul 12, 2023

@cpuu please could you review the open comments on this bug so we can move ahead with merging your code?

I apologize for the delayed response. I have just completed the changes you suggested. Some of the suggestions were applicable and have been implemented, while others fell outside the scope of this specific proposal. I will address those suggestions separately in a future Pull Request to ensure consistency across the project. Thank you for your understanding and valuable feedback.

@cpuu cpuu closed this Jul 12, 2023
@cpuu cpuu reopened this Jul 12, 2023
Copy link
Member

@ikelos ikelos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks very much for making the changes... 5:)

@ikelos ikelos merged commit 89b6c09 into volatilityfoundation:develop Jul 12, 2023
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants