diff --git a/CsabaBarta/malprocfind.py b/CsabaBarta/malprocfind.py index a32728c..658907e 100755 --- a/CsabaBarta/malprocfind.py +++ b/CsabaBarta/malprocfind.py @@ -1489,6 +1489,46 @@ def calculate(self): for pid in list_wo_parent: print "PID %d Offset: 0x%x Name: %s" % (int(list_wo_parent[pid].UniqueProcessId), int(list_wo_parent[pid].obj_offset), str(list_wo_parent[pid].ImageFileName)) + + #Unified output + + + def unified_output (self, data): + return TreeGrid ([ + ("ProcessName", str), + ("PId", int), + ("Parent", str), + ("Name", str), + ("Path", str), + ("Priority", str), + ("CmdLine", str), + ("User", str), + ("Session", str), + ("Time", str), + ("Cmd", str), + ("PHollow", str), + ("Spath", str)], + self.generator(data)) + + + def generator (self, data): + for p in data: + yield (0,[ + str(p['procname']), + int(p['pid']), + str(p['parent']), + str(p['name']), + str(p['path']), + str(p['priority']), + str(p['cmdline']), + str(p['user']), + str(p['session']), + str(p['time']), + str(p['cmd']), + str(p['phollow']), + str(p['spath']) + ]) + def render_text(self, outfd, data): @@ -1548,4 +1588,4 @@ def render_text(self, outfd, data): if p['time'] != None and not p['time']: print " Time: %s" % p['process'].CreateTime if p['spath'] != None and not p['spath']: - print " Path: %s" % str(p['process'].Peb.ProcessParameters.ImagePathName).lower() \ No newline at end of file + print " Path: %s" % str(p['process'].Peb.ProcessParameters.ImagePathName).lower()