Source code for volatility3.plugins.linux.pstree

# This file is Copyright 2021 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at

from volatility3.plugins.linux import pslist

[docs]class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._tasks = {} self._levels = {} self._children = {}
[docs] def find_level(self, pid: int) -> None: """Finds how deep the PID is in the tasks hierarchy. Args: pid: PID to find the level in the hierarchy """ seen = set([pid]) level = 0 proc = self._tasks.get(pid) while proc and proc.parent and not in seen: if proc.is_thread_group_leader: parent_pid = else: parent_pid = proc.tgid child_list = self._children.setdefault(parent_pid, set()) child_list.add( proc = self._tasks.get(parent_pid) level += 1 self._levels[pid] = level
def _generator( self, pid_filter, include_threads: bool = False, decorate_com: bool = False ): """Generates the tasks hierarchy tree. Args: pid_filter: A function which takes a process object and returns True if the process should be ignored/filtered include_threads: If True, the output will also show the user threads If False, only the thread group leaders will be shown Defaults to False. decorate_comm: If True, it decorates the comm string of - User threads: in curly brackets, - Kernel threads: in square brackets Defaults to False. Yields: Each rows """ vmlinux = self.context.modules[self.config["kernel"]] for proc in self.list_tasks( self.context,, filter_func=pid_filter, include_threads=include_threads, ): self._tasks[] = proc # Build the child/level maps for pid in self._tasks: self.find_level(pid) def yield_processes(pid): task = self._tasks[pid] row = self._get_task_fields(task, decorate_com) tid = yield (self._levels[tid] - 1, row) for child_pid in sorted(self._children.get(tid, [])): yield from yield_processes(child_pid) for pid, level in self._levels.items(): if level == 1: yield from yield_processes(pid)