From 0b72e0fdb14e3def3798671af12a1fffb2e43d5f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:34:58 -0600 Subject: [PATCH] Windows Orphan Kernel Threads: Update modules dep, add breaking change This updates the orphan kernel threads plugin to use the latest changes from the modules plugin, updating method signatures and bumping the requirement version number. This required breaking interface changes in the plugin itself, so the major version number has been bumped. Co-authored-by: Andrew Case --- .../plugins/windows/orphan_kernel_threads.py | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 98e5781ae..bae1160d6 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -16,7 +16,9 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of `list_orphan_kernel_threads` + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -38,7 +40,7 @@ class Threads(thrdscan.ThrdScan): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] @@ -46,7 +48,7 @@ class Threads(thrdscan.ThrdScan): def list_orphan_kernel_threads( cls, context: interfaces.context.ContextInterface, - module_name: str, + kernel_module_name: str, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yields thread objects of kernel threads that do not map to a module @@ -57,13 +59,16 @@ class Threads(thrdscan.ThrdScan): Returns: A generator of thread objects of orphaned threads """ - collection = ssdt.SSDT.build_module_collection(context, module_name) - - kernel_space_start = modules.Modules.get_kernel_space_start( - context, module_name + collection = ssdt.SSDT.build_module_collection( + context, + kernel_module_name, ) - for thread in thrdscan.ThrdScan.scan_threads(context, module_name): + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name + ) + + for thread in thrdscan.ThrdScan.scan_threads(context, kernel_module_name): # We don't want smeared or terminated threads # So we access the owning process (which could also be terminated or smeared) # Plus check the start address holding page