From 046c8e4d1e7f3bf9d6857de5601ebd4ab089af6d Mon Sep 17 00:00:00 2001 From: RuBublik Date: Sun, 21 May 2023 18:18:02 +0300 Subject: [PATCH] fix of is_valid - removed reliace on owning _eprocess and added exclusion for system process (does not have creation time) --- .../symbols/windows/extensions/__init__.py | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index e17128897..fe4884dbc 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -499,18 +499,21 @@ class ETHREAD(objects.StructType, pool.ExecutiveObject): """Determine if the object is valid.""" try: - - # validation by thread creation time: - ctime = self.get_create_time() - if not isinstance(ctime, datetime.datetime): - return False - - # validation by parent process: - own_proc = self.owning_process() - # return own_proc.is_valid() - if own_proc.UniqueProcessId % 4 != 0: # NT pids are divisible by 4 + + # validation by TID: + if self.Cid.UniqueThread % 4 != 0: # NT tids are divisible by 4 return False + # validation by PID of parent process: + if self.Cid.UniqueProcess % 4 != 0: + return False + + # validation by thread creation time: + if self.Cid.UniqueProcess != 4: # The System process (PID 4) has no create time + ctime = self.get_create_time() + if not isinstance(ctime, datetime.datetime): + return False + # passed all valitations return True except: