本文整理汇总了Python中volatility.plugins.taskmods.PSList方法的典型用法代码示例。如果您正苦于以下问题：Python taskmods.PSList方法的具体用法？Python taskmods.PSList怎么用？Python taskmods.PSList使用的例子？那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类volatility.plugins.taskmods的用法示例。
在下文中一共展示了taskmods.PSList方法的2个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的Python代码示例。
示例1: main
# 需要导入模块: from volatility.plugins import taskmods [as 别名]
# 或者: from volatility.plugins.taskmods import PSList [as 别名]
def main():
## sys.argv[1] = volatility profile
## sys.argv[2] = full path on disk to your memory sample
config = libapi.get_config(sys.argv[1], sys.argv[2])
data = libapi.get_json(config, taskmods.PSList)
## `data` now contains json with two keys: `columns` and `rows`, where `columns`
## contains a list of column headings (matching the corresponding volatility
## plugin output) and `rows` contains a list of the values for each object found.
## you can either print/save all columns, or you can drill down to a particular
## column by getting the desired column's index as shown below and then accessing
## the index in each row. the following example prints each process' name.
name_index = data['columns'].index('Name')
for row in data['rows']:
print row[name_index] 示例2: pslist
# 需要导入模块: from volatility.plugins import taskmods [as 别名]
# 或者: from volatility.plugins.taskmods import PSList [as 别名]
def pslist(self):
"""Volatility pslist plugin.
@see volatility/plugins/taskmods.py
"""
log.debug("Executing Volatility pslist plugin on "
"{0}".format(self.memdump))
self.__config()
results = []
command = taskmods.PSList(self.config)
for process in command.calculate():
new = {
"process_name": str(process.ImageFileName),
"process_id": int(process.UniqueProcessId),
"parent_id": int(process.InheritedFromUniqueProcessId),
"num_threads": str(process.ActiveThreads),
"num_handles": str(process.ObjectTable.HandleCount),
"session_id": str(process.SessionId),
"create_time": str(process.CreateTime or ""),
"exit_time": str(process.ExitTime or ""),
}
results.append(new)
return dict(config={}, data=results)