WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 10:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

added account for XP timestamps - bit shifted

Browse Source
This commit is contained in:
RuBublik
2024-01-08 23:35:21 +02:00
parent 62466c7953
commit 25637a41e0
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+3
View File
@@ -522,6 +522,9 @@ class ETHREAD(objects.StructType, pool.ExecutiveObject):
return True
def get_create_time(self):
# For Windows XPs
if self.has_member("ThreadsProcess"):
return conversion.wintime_to_datetime(self.CreateTime.QuadPart >> 3)
return conversion.wintime_to_datetime(self.CreateTime.QuadPart)
def get_exit_time(self):