volatility3 icon indicating copy to clipboard operation
volatility3 copied to clipboard

Add support for scanned tasks to various Linux plugins

Open eve-mem opened this issue 2 years ago • 15 comments

A lot of the linux plugins start from a task struct and provide lots of extra information about the processes. e.g. envvars, lsof, sockstat, psaux.

It would be great to allow this functionality to task structs found by scanning too. However the question is how to allow actually the user to this.

eve-mem avatar Mar 11 '23 18:03 eve-mem

This issue is stale because it has been open for 200 days with no activity.

github-actions[bot] avatar Sep 28 '23 01:09 github-actions[bot]

I've made no major progress on this yet. I still do think it's a useful feature to add. I'll work on a simple example and see if it works well before adding support for everything.

eve-mem avatar Sep 28 '23 08:09 eve-mem

This issue is stale because it has been open for 200 days with no activity.

github-actions[bot] avatar Apr 17 '24 01:04 github-actions[bot]

Removing the stale flag and bumping because this sounds like it might one day be a useful feature to have. I need to revisit that draft at some point...

ikelos avatar Apr 28 '24 23:04 ikelos