Skip to content

Commit 8f9bebd

Browse files
committed
Linux PsList: Fix process list traversal
Fixes linux process listing by traversing the list backwards as well as forwards while tracking seen process offsets to avoid duplicates.
1 parent 17f9d21 commit 8f9bebd

File tree

1 file changed

+21
-11
lines changed

1 file changed

+21
-11
lines changed

volatility3/framework/plugins/linux/pslist.py

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -262,17 +262,27 @@ def list_tasks(
262262
init_task = vmlinux.object_from_symbol(symbol_name="init_task")
263263

264264
# Note that the init_task itself is not yielded, since "ps" also never shows it.
265-
for task in init_task.tasks:
266-
if not task.is_valid():
267-
continue
268-
269-
if filter_func(task):
270-
continue
271-
272-
yield task
273-
274-
if include_threads:
275-
yield from task.get_threads()
265+
seen = set()
266+
for forward in (True, False):
267+
for task in init_task.tasks.to_list(
268+
symbol_type=init_task.vol.type_name,
269+
member="tasks",
270+
forward=forward,
271+
):
272+
if task.vol.offset in seen:
273+
continue
274+
seen.add(task.vol.offset)
275+
276+
if not task.is_valid():
277+
continue
278+
279+
if filter_func(task):
280+
continue
281+
282+
yield task
283+
284+
if include_threads:
285+
yield from task.get_threads()
276286

277287
def run(self):
278288
pids = self.config.get("pid")

0 commit comments

Comments
 (0)