Skip to content

Commit 7323bd3

Browse files
author
616c696365
committed
windows.pslist process name added to dumped file by default
1 parent 5d43071 commit 7323bd3

File tree

1 file changed

+5
-14
lines changed
  • volatility3/framework/plugins/windows

1 file changed

+5
-14
lines changed

volatility3/framework/plugins/windows/pslist.py

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,6 @@ def get_requirements(cls):
5050
default=False,
5151
optional=True,
5252
),
53-
requirements.BooleanRequirement(
54-
name="friendly",
55-
description="Display process name in dump filename",
56-
default=False,
57-
optional=True,
58-
),
5953
]
6054

6155
@classmethod
@@ -66,7 +60,6 @@ def process_dump(
6660
pe_table_name: str,
6761
proc: interfaces.objects.ObjectInterface,
6862
open_method: Type[interfaces.plugins.FileHandlerInterface],
69-
friendly: bool = False,
7063
) -> interfaces.plugins.FileHandlerInterface:
7164
"""Extracts the complete data for a process as a FileHandlerInterface
7265
@@ -103,14 +96,13 @@ def process_dump(
10396
max_length=proc.ImageFileName.vol.count,
10497
errors="replace",
10598
)
106-
if friendly:
107-
file_handle = open_method(
99+
100+
file_handle = open_method(
101+
open_method.sanitize_filename(
108102
f"{proc.UniqueProcessId}.{process_name}.{peb.ImageBaseAddress:#x}.dmp"
109103
)
110-
else:
111-
file_handle = open_method(
112-
f"pid.{proc.UniqueProcessId}.{peb.ImageBaseAddress:#x}.dmp"
113-
)
104+
)
105+
114106
for offset, data in dos_header.reconstruct():
115107
file_handle.seek(offset)
116108
file_handle.write(data)
@@ -261,7 +253,6 @@ def _generator(self):
261253
pe_table_name,
262254
proc,
263255
self.open,
264-
self.config["friendly"],
265256
)
266257
file_output = "Error outputting file"
267258
if file_handle:

0 commit comments

Comments
 (0)