add _KDDEBUGGER_DATA64.processes() and _KDDEBUGGER_DATA64.modules() generators to replace much of the code in win32.tasks and win32.modules. this is mostly for API and ease-of-use. plus in the future if windows processes need to be enumerated differently, we can easily subclass _KDDEBUGGER_DATA64

volatility/plugins/overlays/windows/kdbg_vtypes.py

@@ -33,6 +33,25 @@ class _KDDEBUGGER_DATA64(obj.CType):
         csdresult = obj.Object("unsigned long", offset = self.CmNtCSDVersion, vm = self.obj_vm)
         return (csdresult >> 8) & 0xffffffff  
 
+    def processes(self):
+        """Enumerate processes"""
+        list_head = self.PsActiveProcessHead.dereference_as("_LIST_ENTRY")
+        if not list_head:
+            raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan")
+
+        for l in list_head.list_of_type("_EPROCESS", "ActiveProcessLinks"):
+            yield l            
+        
+    def modules(self):
+        """Enumerate modules"""
+        list_head = self.PsLoadedModuleList.dereference_as("_LIST_ENTRY")
+        if not list_head:
+            raise AttributeError("Could not list modules, please verify your --profile with kdbgscan")
+
+        for l in list_head.dereference_as("_LIST_ENTRY").list_of_type(
+            "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"):
+            yield l
+
     def dbgkd_version64(self):
         """Scan backwards from the base of KDBG to find the 
         _DBGKD_GET_VERSION64. We have a winner when kernel 

volatility/win32/modules.py

@@ -27,14 +27,7 @@
 import volatility.win32.tasks as tasks
 
 def lsmod(addr_space):
-    """ A Generator for modules (uses _KPCR symbols) """
-    ## Locate the kpcr struct - either hard coded or specified by the command line
+    """ A Generator for modules """
 
-    PsLoadedModuleList = tasks.get_kdbg(addr_space).PsLoadedModuleList
-
-    if PsLoadedModuleList.is_valid():
-        ## Try to iterate over the process list in PsActiveProcessHead
-        ## (its really a pointer to a _LIST_ENTRY)
-        for l in PsLoadedModuleList.dereference_as("_LIST_ENTRY").list_of_type(
-            "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"):
-            yield l
+    for m in tasks.get_kdbg(addr_space).modules():
+        yield m

volatility/win32/tasks.py

@@ -30,13 +30,8 @@
 
 import volatility.obj as obj
 import volatility.debug as debug #pylint: disable-msg=W0611
-import volatility.exceptions as exceptions
 from bisect import bisect_right
 
-class TasksNotFound(exceptions.VolatilityException):
-    """Thrown when a tasklist cannot be determined"""
-    pass
-
 def get_kdbg(addr_space):
     """A function designed to return the KDDEBUGGER structure from an address space"""
 
@@ -70,18 +65,10 @@ def get_kdbg(addr_space):
     return obj.NoneObject("KDDEBUGGER structure not found using either KDBG signature or KPCR pointer")
 
 def pslist(addr_space):
-    """ A Generator for _EPROCESS objects (uses _KPCR symbols) """
+    """ A Generator for _EPROCESS objects """
 
-    PsActiveProcessHead = get_kdbg(addr_space).PsActiveProcessHead
-
-    PsActiveList = PsActiveProcessHead.dereference_as("_LIST_ENTRY")
-    if PsActiveList:
-        # Try to iterate over the process list in PsActiveProcessHead
-        # (its really a pointer to a _LIST_ENTRY)
-        for l in PsActiveList.list_of_type("_EPROCESS", "ActiveProcessLinks"):
-            yield l
-    else:
-        raise TasksNotFound("Could not list tasks, please verify the --profile option and whether this image is valid")
+    for p in get_kdbg(addr_space).processes():
+        yield p
 
 def find_space(addr_space, procs, mod_base):
     """Search for an address space (usually looking for a GUI process)"""