volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.72k stars 461 forks source link

Registry layer relies on standard plugin #1334

Open ikelos opened 2 weeks ago

ikelos commented 2 weeks ago

Describe the bug A core part of the framework (registry layer) relies on pslist to figure out the process that the registry lives in. This is an awkward introduces a lot of cross-dependency that shouldn't exist. We should try to find a way to achieve the same goal without pulling in so much extra gubbins just to find the process list. I'd almost be happy duplicating code, or storing it in a separate common module (perhaps the generic process work from #1000 could help)?

See #1307 for more details.