diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 98e5781ae..bae1160d6 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -16,7 +16,9 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of `list_orphan_kernel_threads` + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -38,7 +40,7 @@ class Threads(thrdscan.ThrdScan): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] @@ -46,7 +48,7 @@ class Threads(thrdscan.ThrdScan): def list_orphan_kernel_threads( cls, context: interfaces.context.ContextInterface, - module_name: str, + kernel_module_name: str, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yields thread objects of kernel threads that do not map to a module @@ -57,13 +59,16 @@ class Threads(thrdscan.ThrdScan): Returns: A generator of thread objects of orphaned threads """ - collection = ssdt.SSDT.build_module_collection(context, module_name) - - kernel_space_start = modules.Modules.get_kernel_space_start( - context, module_name + collection = ssdt.SSDT.build_module_collection( + context, + kernel_module_name, ) - for thread in thrdscan.ThrdScan.scan_threads(context, module_name): + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name + ) + + for thread in thrdscan.ThrdScan.scan_threads(context, kernel_module_name): # We don't want smeared or terminated threads # So we access the owning process (which could also be terminated or smeared) # Plus check the start address holding page