I am trying to create a BASH script that will run a command, filter the output of that command and then read the results of that output to then print only sections that meet the given requirement.
I have managed to reduce the output of the original command so that the output looks like this:
Profile: 1 PsA of Profile 1: 13 PsL of Profile 1: 15 Profile: 2 PsA of Profile 2: 0 PsL of Profile 2: 0
I am trying to write a BASH script that will read each Profile section individually, and only print the profile numbers that have PsA and PsL values of over 0.
For clarity, the output needs to be only the profile value, so in this example - 1, with 2 discarded.
It also does need to be a BASH script due to the work that I am trying to do.
I am really new to all of this, and am utterly stuck. Please help!
** EDIT ** For clarity, I am trying to work with the Volatility Framework. I am looking at the profiles that can be obtained, and currently - the exact output looks like this:
Profile suggestion (KDBGHeader): WinXPSP3x86 PsActiveProcessHead : 0x8055a158 (31 processes) PsLoadedModuleList : 0x80553fc0 (122 modules) Profile suggestion (KDBGHeader): WinXPSP2x86 PsActiveProcessHead : 0x8055a158 (31 processes) PsLoadedModuleList : 0x80553fc0 (122 modules)
What I need is for the script to check the PsActiveProcessHead and PsLoadedModuleList (PsA and PsL) - specifically, the number of processes and modules found - if BOTH of those, which are shown in brackets, are above 0 then print the Profile suggestion. There may be 1 profile suggestion, there may be more - I need the script to output any profile found that has both modules and processes listed above 0.
My apologies for the unclear original question, I tried to make it simpler and adapt the answers but am still struggling. Sorry!
(To be abundantly clear, the above is just an example of the output format, they will not always both have numbers above 0 and there may be more than 2 profile suggestions)