From 64ecd65d2c8ccb5e9284182104266e97d8fabce4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 14:37:29 -0500 Subject: [PATCH 1/7] Windows: Improve type-hints in thrdscan, extensions This improves type-hinting in the `ThrdScan` class and in the `ETHREAD` extension class through narrowing the return type of some methods from `interfaces.objects.ObjectInterface` to their actual return type, `extensions.ETHREAD`. Also creates a `NamedTuple` for holding thread info, which cleans up the type signature and makes the returned value easier for consumers to use. --- .../framework/plugins/windows/thrdscan.py | 77 ++++++++----------- .../symbols/windows/extensions/__init__.py | 10 ++- 2 files changed, 41 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 0ac3d0c33..49103cc7e 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -1,15 +1,16 @@ ## ## plugin for testing addition of threads scan support to poolscanner.py ## -import logging import datetime -from typing import Callable, Iterable, Tuple, Optional, Dict +import logging +from typing import Callable, Dict, NamedTuple, Optional, Union, Tuple, Iterator -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import poolscanner, pe_symbols +from volatility3.framework.symbols.windows import extensions as win_extensions from volatility3.plugins import timeliner +from volatility3.plugins.windows import pe_symbols, poolscanner vollog = logging.getLogger(__name__) @@ -21,6 +22,17 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) _required_framework_version = (2, 6, 0) _version = (2, 0, 0) + class ThreadInfo(NamedTuple): + offset: int + pid: objects.Pointer + tid: objects.Pointer + start_addr: objects.Pointer + start_path: Optional[str] + win32_start_addr: objects.Pointer + win32_start_path: Optional[str] + create_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue] + exit_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue] + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.implementation = self.scan_threads @@ -51,7 +63,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) cls, context: interfaces.context.ContextInterface, module_name: str, - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Iterator[win_extensions.ETHREAD]: """Scans for threads using the poolscanner module and constraints. Args: @@ -77,19 +89,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) @classmethod def gather_thread_info( cls, - ethread: interfaces.objects.ObjectInterface, - vads_cache: Dict[int, pe_symbols.ranges_type] = None, - ) -> Tuple[ - int, - int, - int, - int, - Optional[str], - int, - Optional[str], - Optional[datetime.datetime], - Optional[datetime.datetime], - ]: + ethread: win_extensions.ETHREAD, + vads_cache: Optional[Dict[int, pe_symbols.ranges_type]] = None, + ) -> Optional[ThreadInfo]: try: thread_offset = ethread.vol.offset owner_proc_pid = ethread.Cid.UniqueProcess @@ -135,19 +137,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) start_path = None win32start_path = None - return ( - format_hints.Hex(thread_offset), + return cls.ThreadInfo( + thread_offset, owner_proc_pid, thread_tid, - format_hints.Hex(thread_start_addr), + thread_start_addr, start_path, - format_hints.Hex(thread_win32start_addr), + thread_win32start_addr, win32start_path, thread_create_time, thread_exit_time, ) - def _generator(self, filter_func: Callable): + def _generator(self, filter_func: Callable) -> Iterator[Tuple[int, Tuple]]: kernel_name = self.config["kernel"] vads_cache: Dict[int, pe_symbols.ranges_type] = {} @@ -156,27 +158,16 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) info = self.gather_thread_info(ethread, vads_cache) if info: - ( - offset, - pid, - tid, - start_addr, - start_path, - win32start_addr, - win32start_path, - create_time, - exit_time, - ) = info yield 0, ( - offset, - pid, - tid, - start_addr, - start_path or renderers.NotAvailableValue(), - win32start_addr, - win32start_path or renderers.NotAvailableValue(), - create_time, - exit_time, + format_hints.Hex(info.offset), + info.pid, + info.tid, + format_hints.Hex(info.start_addr), + info.start_path or renderers.NotAvailableValue(), + format_hints.Hex(info.win32_start_addr), + info.win32_start_path or renderers.NotAvailableValue(), + info.create_time, + info.exit_time, ) def generate_timeline(self): diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 9fe250ba5..1972d6a50 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -568,16 +568,20 @@ class ETHREAD(objects.StructType, pool.ExecutiveObject): # passed all validations return True - def get_create_time(self): + def get_create_time( + self, + ) -> Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]: # For Windows XPs if self.has_member("ThreadsProcess"): return conversion.wintime_to_datetime(self.CreateTime.QuadPart >> 3) return conversion.wintime_to_datetime(self.CreateTime.QuadPart) - def get_exit_time(self): + def get_exit_time( + self, + ) -> Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]: return conversion.wintime_to_datetime(self.ExitTime.QuadPart) - def owning_process(self) -> interfaces.objects.ObjectInterface: + def owning_process(self) -> "EPROCESS": """Return the EPROCESS that owns this thread.""" # For Windows XPs From aba3b04e8da6c82b142b0e38011b6c50613d6823 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 14:53:20 -0500 Subject: [PATCH 2/7] Windows Thrdscan: Fix thread filtering + tracebacks Tracebacks were occurring across a number of samples when running the threads/threadscan plugins due to uncaught `InvalidAddressExceptions`. Further investigations led to the discovery of some incorrect thread filtering that was missing valid threads. --- .../framework/constants/windows/__init__.py | 2 ++ .../framework/plugins/windows/thrdscan.py | 16 +++++++++++++--- .../symbols/windows/extensions/__init__.py | 6 +++++- 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py index 6f37acd2d..b08713cc9 100644 --- a/volatility3/framework/constants/windows/__init__.py +++ b/volatility3/framework/constants/windows/__init__.py @@ -28,3 +28,5 @@ PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( # CR3 register within structures describing initial processor state to be started PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes + +MAX_PID = 0xFFFFFFFC diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 49103cc7e..162e41929 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -7,6 +7,7 @@ from typing import Callable, Dict, NamedTuple, Optional, Union, Tuple, Iterator from volatility3.framework import exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements +from volatility3.framework.constants import windows as windows_constants from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import extensions as win_extensions from volatility3.plugins import timeliner @@ -112,10 +113,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None - # don't look for VADs in kernel threads, just let them get reported with empty paths + # Filter junk PIDs if ( - owner_proc_pid != 4 - and owner_proc.InheritedFromUniqueProcessId != 4 + ethread.Cid.UniqueProcess > windows_constants.MAX_PID + or ethread.Cid.UniqueProcess == 0 + or ethread.Cid.UniqueProcess % 4 != 0 + ): + return None + + # Get VAD mappings for valid non-system (PID 4) processes + if ( + owner_proc + and owner_proc.is_valid() + and owner_proc.UniqueProcessId != 4 and vads_cache is not None ): vads = pe_symbols.PESymbols.get_vads_for_process_cache( diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 1972d6a50..e6850dde5 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -709,7 +709,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return False # NT pids are divisible by 4 - if self.UniqueProcessId % 4 != 0: + if ( + self.UniqueProcessId % 4 != 0 + or self.UniqueProcessId == 0 + or self.UniqueProcessId > constants.windows.MAX_PID + ): return False # check for all 0s besides the PCID entries From b35f0a29bc8eab919602acbcf5626f11c7638afd Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 16:26:48 -0500 Subject: [PATCH 3/7] Windows: Remove VAD length check in thread enumeration This exclusion of threads where there are < 5 vads seems to filter valid threads (at least, threads where the start address or Win32 start address values are readable and valid disassembly, and the start time makes sense in the context of the parent process). --- .../framework/plugins/windows/thrdscan.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 162e41929..a3024fe58 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -131,17 +131,16 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - if not vads or len(vads) < 5: - vollog.debug( - f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" - ) - return None - start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_start_addr + start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_start_addr) + if vads + else None ) - win32start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_win32start_addr + win32start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_win32start_addr) + if vads + else None ) else: start_path = None From da73a506620c73ac0642132428b5c06bd76613c3 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 9 Apr 2025 21:41:01 -0500 Subject: [PATCH 4/7] Windows ThrdScan: Bump patch version number Bumping patch version due to bug fixes. --- volatility3/framework/plugins/windows/debugregisters.py | 4 ++-- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- volatility3/framework/plugins/windows/psxview.py | 4 ++-- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- volatility3/framework/plugins/windows/suspicious_threads.py | 6 +++--- volatility3/framework/plugins/windows/thrdscan.py | 2 +- volatility3/framework/plugins/windows/threads.py | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 74434a3cc..40a5e31aa 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -24,7 +24,7 @@ vollog = logging.getLogger(__name__) class DebugRegisters(interfaces.plugins.PluginInterface): # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List: @@ -38,7 +38,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index b4dec0fc5..300d6069f 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -18,7 +18,7 @@ class Threads(thrdscan.ThrdScan): _required_framework_version = (2, 4, 0) # 2.0.0 - changed the signature of `list_orphan_kernel_threads` - _version = (2, 0, 0) + _version = (2, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -34,7 +34,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 142987c3e..c4f4b340f 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -34,7 +34,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter # code I do have from it, and will happily share it if anyone else wants to add it. _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) valid_proc_name_chars = set( string.ascii_lowercase + string.ascii_uppercase + "." + " " @@ -55,7 +55,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 82d44a6d7..1cde0429b 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -19,7 +19,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): """Enumerates suspended threads.""" _required_framework_version = (2, 13, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), ] diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index eabc637c8..16da74c00 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -17,7 +17,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): """Lists suspicious userland process threads""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,13 +35,13 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index a3024fe58..1402e7bd2 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -21,7 +21,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) class ThreadInfo(NamedTuple): offset: int diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index d040fa990..5531b4b24 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -32,7 +32,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) From f091641920cda3a285ae2b633a8412e38f9501cc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 9 Apr 2025 21:50:36 -0500 Subject: [PATCH 5/7] Framework: Bump patch version number Bumping the framework patch version number due to bugfix in windows' `EPROCESS` extension class' `is_valid()` method. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index a299f15a2..07b9e45ec 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_PATCH = 2 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 6237950991e7d78718bd6931c1598afac325043f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 09:50:49 -0500 Subject: [PATCH 6/7] Windows: Revert unneeded version bumps --- volatility3/framework/plugins/windows/debugregisters.py | 4 ++-- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- volatility3/framework/plugins/windows/psxview.py | 4 ++-- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- volatility3/framework/plugins/windows/suspicious_threads.py | 6 +++--- volatility3/framework/plugins/windows/threads.py | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 40a5e31aa..74434a3cc 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -24,7 +24,7 @@ vollog = logging.getLogger(__name__) class DebugRegisters(interfaces.plugins.PluginInterface): # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 0, 2) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List: @@ -38,7 +38,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 300d6069f..b4dec0fc5 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -18,7 +18,7 @@ class Threads(thrdscan.ThrdScan): _required_framework_version = (2, 4, 0) # 2.0.0 - changed the signature of `list_orphan_kernel_threads` - _version = (2, 0, 1) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -34,7 +34,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index c4f4b340f..142987c3e 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -34,7 +34,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter # code I do have from it, and will happily share it if anyone else wants to add it. _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 0) valid_proc_name_chars = set( string.ascii_lowercase + string.ascii_uppercase + "." + " " @@ -55,7 +55,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 1cde0429b..82d44a6d7 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -19,7 +19,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): """Enumerates suspended threads.""" _required_framework_version = (2, 13, 0) - _version = (1, 0, 1) + _version = (1, 0, 0) @classmethod def get_requirements(cls): @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 16da74c00..eabc637c8 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -17,7 +17,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): """Lists suspicious userland process threads""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 2) + _version = (2, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,13 +35,13 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 5531b4b24..d040fa990 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (3, 0, 1) + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -32,7 +32,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) From b82458e365149ee9255235be1751b6559fa8199c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 09:51:32 -0500 Subject: [PATCH 7/7] Windows Thrdscan: Convert from PATCH to MINOR version bump --- volatility3/framework/plugins/windows/thrdscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 1402e7bd2..d5a1a0b07 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -21,7 +21,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (2, 0, 1) + _version = (2, 1, 0) class ThreadInfo(NamedTuple): offset: int