Windows: Add --name option to pslist plugin

doc/source/simple-plugin.rst

@@ -189,7 +189,7 @@ that will be output as part of the :py:class:`~volatility3.framework.interfaces.
                                       self._generator(pslist.PsList.list_processes(self.context,
                                                                                    kernel.layer_name,
                                                                                    kernel.symbol_table_name,
-                                                                                   filter_func = filter_func)))
+                                                                                   filter_funcs = [filter_func])))
 
 In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters).
 It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if

volatility3/framework/plugins/windows/cmdline.py

@@ -101,7 +101,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/dlllist.py

@@ -237,7 +237,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/dumpfiles.py

@@ -363,7 +363,7 @@ def run(self):
                 self.context,
                 kernel.layer_name,
                 kernel.symbol_table_name,
-                filter_func=filter_func,
+                filter_funcs=[filter_func],
             )
 
         return renderers.TreeGrid(

volatility3/framework/plugins/windows/envars.py

@@ -237,7 +237,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/getsids.py

@@ -222,7 +222,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/handles.py

@@ -431,7 +431,7 @@ def run(self):
                     self.context,
                     kernel.layer_name,
                     kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/ldrmodules.py

@@ -120,7 +120,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/malfind.py

@@ -240,7 +240,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/memmap.py

@@ -118,7 +118,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/modscan.py

@@ -101,7 +101,7 @@ def get_session_layers(
             context=context,
             layer_name=layer_name,
             symbol_table=symbol_table,
-            filter_func=filter_func,
+            filter_funcs=[filter_func],
         ):
             proc_id = "Unknown"
             try:

volatility3/framework/plugins/windows/modules.py

@@ -122,7 +122,7 @@ def get_session_layers(
             context=context,
             layer_name=layer_name,
             symbol_table=symbol_table,
-            filter_func=filter_func,
+            filter_funcs=[filter_func],
         ):
             proc_id = "Unknown"
             try:

volatility3/framework/plugins/windows/privileges.py

@@ -123,7 +123,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/pslist.py

@@ -50,6 +50,12 @@ def get_requirements(cls):
                 default=False,
                 optional=True,
             ),
+            requirements.ListRequirement(
+                name="name",
+                element_type=str,
+                description="Name of the process(es) to include (all other processes are excluded). Filter is case-sensitive and match full process name only",
+                optional=True,
+            ),
         ]
 
     @classmethod
@@ -171,9 +177,7 @@ def list_processes(
         context: interfaces.context.ContextInterface,
         layer_name: str,
         symbol_table: str,
-        filter_func: Callable[
-            [interfaces.objects.ObjectInterface], bool
-        ] = lambda _: False,
+        filter_funcs: List[Callable[[interfaces.objects.ObjectInterface], bool]] = None,
     ) -> Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the processes in the primary layer that are in the pid
         config option.
@@ -216,7 +220,10 @@ def list_processes(
         )
 
         for proc in eproc.ActiveProcessLinks:
-            if not filter_func(proc):
+            if filter_funcs:
+                if any(not filter_func(proc) for filter_func in filter_funcs):
+                    yield proc
+            else:
                 yield proc
 
     def _generator(self):
@@ -230,12 +237,21 @@ def _generator(self):
         if not isinstance(memory, layers.intel.Intel):
             raise TypeError("Primary layer is not an intel layer")
 
-        for proc in self.list_processes(
+        filter_funcs = []
+
+        if self.config["pid"]:
+            filter_funcs.append(self.create_pid_filter(self.config.get("pid")))
+        if self.config["name"]:
+            filter_funcs.append(self.create_name_filter(self.config.get("name")))
+
+        processes = self.list_processes(
             self.context,
             kernel.layer_name,
             kernel.symbol_table_name,
-            filter_func=self.create_pid_filter(self.config.get("pid", None)),
-        ):
+            filter_funcs=filter_funcs,
+        )
+
+        for proc in processes:
             if not self.config.get("physical", self.PHYSICAL_DEFAULT):
                 offset = proc.vol.offset
             else:

volatility3/framework/plugins/windows/sessions.py

@@ -49,7 +49,7 @@ def _generator(self):
             self.context,
             kernel.layer_name,
             kernel.symbol_table_name,
-            filter_func=filter_func,
+            filter_funcs=[filter_func],
         ):
             session_id = proc.get_session_id()
 

volatility3/framework/plugins/windows/skeleton_key_check.py

@@ -706,7 +706,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=self._lsass_proc_filter,
+                    filter_funcs=[self._lsass_proc_filter],
                 )
             ),
         )

volatility3/framework/plugins/windows/svcscan.py

@@ -269,7 +269,7 @@ def _generator(self):
             context=self.context,
             layer_name=kernel.layer_name,
             symbol_table=kernel.symbol_table_name,
-            filter_func=filter_func,
+            filter_funcs=[filter_func],
         ):
             proc_id = "Unknown"
             try:

volatility3/framework/plugins/windows/vadinfo.py

@@ -275,7 +275,7 @@ def run(self):
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/vadwalk.py

@@ -87,7 +87,7 @@ def run(self) -> renderers.TreeGrid:
                     context=self.context,
                     layer_name=kernel.layer_name,
                     symbol_table=kernel.symbol_table_name,
-                    filter_func=filter_func,
+                    filter_funcs=[filter_func],
                 )
             ),
         )

volatility3/framework/plugins/windows/vadyarascan.py

@@ -63,7 +63,7 @@ def _generator(self):
             context=self.context,
             layer_name=kernel.layer_name,
             symbol_table=kernel.symbol_table_name,
-            filter_func=filter_func,
+            filter_funcs=[filter_func],
         ):
             layer_name = task.add_process_layer()
             layer = self.context.layers[layer_name]