From 39c97b8e9795892f0fbf6851154f66f62bb1871b Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 20 Dec 2021 15:26:45 +1100
Subject: [PATCH] Moving thread type check methods to the task object

---
 volatility3/framework/plugins/linux/pslist.py | 20 +++-----------
 .../symbols/linux/extensions/__init__.py      | 27 +++++++++++++++++++
 2 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py
index b42453d3c..4c55f853c 100644
--- a/volatility3/framework/plugins/linux/pslist.py
+++ b/volatility3/framework/plugins/linux/pslist.py
@@ -3,7 +3,7 @@
 #
 from typing import Callable, Iterable, List, Any, Tuple
 
-from volatility3.framework import renderers, interfaces, constants
+from volatility3.framework import renderers, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols import linux
@@ -57,18 +57,6 @@ class PsList(interfaces.plugins.PluginInterface):
         else:
             return lambda _: False
 
-    @staticmethod
-    def task_is_kernel_thread(task: interfaces.objects.ObjectInterface) -> bool:
-        return (task.flags & constants.linux.PF_KTHREAD) != 0
-
-    @staticmethod
-    def task_is_thread_group_leader(task: interfaces.objects.ObjectInterface) -> bool:
-        return task.tgid == task.pid
-
-    @staticmethod
-    def task_is_user_thread(task: interfaces.objects.ObjectInterface) -> bool:
-        return task.tgid != task.pid
-
     def _get_task_fields(
             self,
             task: interfaces.objects.ObjectInterface,
@@ -89,9 +77,9 @@ class PsList(interfaces.plugins.PluginInterface):
         ppid = task.parent.tgid if task.parent else 0
         name = utility.array_to_string(task.comm)
         if decorate_comm:
-            if self.task_is_kernel_thread(task):
+            if task.is_kernel_thread:
                 name = f"[{name}]"
-            elif self.task_is_user_thread(task):
+            elif task.is_user_thread:
                 name = f"{{{name}}}"
 
         task_fields = (pid, tid, ppid, name)
@@ -154,7 +142,7 @@ class PsList(interfaces.plugins.PluginInterface):
             next_task = task.thread_group.next
             while current_task is None or current_task.vol.offset != task.vol.offset:
                 current_task = linux.LinuxUtilities.container_of(next_task, "task_struct", "thread_group", vmlinux)
-                if cls.task_is_thread_group_leader(current_task):
+                if current_task.is_thread_group_leader:
                     # Making sure the first task yielded is the Task Group Leader
                     yield current_task
                 elif include_threads:
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 0edd60608..f28705617 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -201,6 +201,33 @@ class task_struct(generic.GenericIntelProcess):
 
             yield (start, end - start)
 
+    @property
+    def is_kernel_thread(self) -> bool:
+        """Checks if this task is a kernel thread.
+
+        Returns:
+            bool: True, if this task is a kernel thread. Otherwise, False.
+        """
+        return (self.flags & constants.linux.PF_KTHREAD) != 0
+
+    @property
+    def is_thread_group_leader(self) -> bool:
+        """Checks if this task is a thread group leader.
+
+        Returns:
+            bool: True, if this task is a thread group leader. Otherwise, False.
+        """
+        return self.tgid == self.pid
+
+    @property
+    def is_user_thread(self) -> bool:
+        """Checks if this task is a user thread.
+
+        Returns:
+            bool: True, if this task is a user thread. Otherwise, False.
+        """
+        return not self.is_kernel_thread and self.tgid != self.pid
+
 
 class fs_struct(objects.StructType):