From bade5584c2f7befbbb74fc23b1669e84e5e84be5 Mon Sep 17 00:00:00 2001
From: atcuno <andrew@memoryanalysis.net>
Date: Tue, 22 Jan 2013 04:06:53 +0000
Subject: [PATCH] Mac - add start time to pslist

---
 volatility/plugins/mac/pslist.py | 36 ++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/volatility/plugins/mac/pslist.py b/volatility/plugins/mac/pslist.py
index 61b2c257..9b0b976a 100644
--- a/volatility/plugins/mac/pslist.py
+++ b/volatility/plugins/mac/pslist.py
@@ -20,6 +20,7 @@
 @contact:      atcuno@gmail.com
 @organization: 
 """
+import time
 
 import volatility.obj as obj
 import common
@@ -55,11 +56,42 @@ class mac_pslist(common.AbstractMacCommand):
 
             proc = proc.p_list.le_next
 
-    def render_text(self, outfd, data):
+    #### move this to an overlay for 'proc'
+    def _get_proc_start_time(self, proc):
+        nsecs_per = 1000000
         
+        start_time = proc.p_start 
+
+        start_secs = start_time.tv_sec + (start_time.tv_usec / nsecs_per)
+
+        sec = start_secs
+
+        # protect against invalid data in unallocated tasks
+        try:
+            ret = time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(sec))
+        except ValueError:
+            ret = ""
+
+        return ret
+
+    def render_text(self, outfd, data):
+        self.table_header(outfd, [("Offset", "[addrpad]"),
+                          ("Name", "20"),
+                          ("Pid", "15"),
+                          ("Uid", "15"),
+                          ("Gid", "9"),
+                          ("Start Time", "")])
+
         for proc in data:
             name = common.get_string(proc.p_comm.obj_offset, self.addr_space)
-            outfd.write("%d | %s\n" % (proc.p_pid, name))
+            self.table_row(outfd, proc.obj_offset,
+                                  name,
+                                  str(proc.p_pid),
+                                  str(proc.p_ucred.cr_uid),
+                                  str(proc.p_ucred.cr_gmuid),
+                                  self._get_proc_start_time(proc))
+
+