From 23cd3090459d5c953b18c1912b0d1902806fc4cc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:53:46 -0600 Subject: [PATCH] Windows Threads: Change list_process_threads signature This updates the windows.threads plugin with a method signature change: `module_name` is now `kernel_module_name` for clarity. Co-authored-by: Andrew Case --- .../framework/plugins/windows/threads.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index f962a3fed..806caaa52 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -59,16 +59,18 @@ class Threads(thrdscan.ThrdScan): @classmethod def list_process_threads( - cls, context: interfaces.context.ContextInterface, module_name: str + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Runs through all processes and lists threads for each process""" - module = context.modules[module_name] - layer_name = module.layer_name - symbol_table_name = module.symbol_table_name + module = context.modules[kernel_module_name] + + filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table_name, + context, + kernel_module_name, + filter_func=filter_func, ): yield from cls.list_threads(module, proc)