WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-23 18:14:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows Orphan Kernel Threads: Update modules dep, add breaking change

Browse Source 
This updates the orphan kernel threads plugin to use the latest changes
from the modules plugin, updating method signatures and bumping the
requirement version number. This required breaking interface changes in
the plugin itself, so the major version number has been bumped.

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent 7bfbc26d67
commit 0b72e0fdb1
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/orphan_kernel_threads.py
+13 -8
View File
@@ -16,7 +16,9 @@ class Threads(thrdscan.ThrdScan):
"""Lists process threads"""
_required_framework_version = (2, 4, 0)
_version = (1, 0, 0)
# 2.0.0 - changed the signature of `list_orphan_kernel_threads`
_version = (2, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
@@ -38,7 +40,7 @@ class Threads(thrdscan.ThrdScan):
name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="modules", plugin=modules.Modules, version=(2, 1, 0)
name="modules", plugin=modules.Modules, version=(3, 0, 0)
),
]
@@ -46,7 +48,7 @@ class Threads(thrdscan.ThrdScan):
def list_orphan_kernel_threads(
cls,
context: interfaces.context.ContextInterface,
module_name: str,
kernel_module_name: str,
) -> Generator[interfaces.objects.ObjectInterface, None, None]:
"""Yields thread objects of kernel threads that do not map to a module
@@ -57,13 +59,16 @@ class Threads(thrdscan.ThrdScan):
Returns:
A generator of thread objects of orphaned threads
"""
collection = ssdt.SSDT.build_module_collection(context, module_name)
kernel_space_start = modules.Modules.get_kernel_space_start(
context, module_name
collection = ssdt.SSDT.build_module_collection(
context,
kernel_module_name,
)
for thread in thrdscan.ThrdScan.scan_threads(context, module_name):
kernel_space_start = modules.Modules.get_kernel_space_start(
context, kernel_module_name
)
for thread in thrdscan.ThrdScan.scan_threads(context, kernel_module_name):
# We don't want smeared or terminated threads
# So we access the owning process (which could also be terminated or smeared)
# Plus check the start address holding page