From 1125be122e8d330cad156ba67a279bf83f22c2f0 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 10 May 2022 12:31:56 +0900 Subject: [PATCH] Add: code comment for windows version --- volatility3/framework/symbols/windows/extensions/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ccfcb4290..a1c347ed2 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -450,6 +450,7 @@ class ETHREAD(objects.StructType): def owning_process(self) -> interfaces.objects.ObjectInterface: """Return the EPROCESS that owns this thread.""" + if(self.has_member("ThreadsProcess")): return self.ThreadsProcess.dereference().cast("_EPROCESS") elif(self.has_member("Tcb") and self.Tcb.has_member("Process")):