From 3a4e622854708ebd0b8bb4bc48c57ceb2db61828 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 20:19:59 -0500 Subject: [PATCH] Change pending checking and OS version --- volatility3/framework/plugins/windows/processghosting.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 023ee877a..6e91a72cd 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -99,7 +99,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: delete_pending = None - if delete_pending and delete_pending == 1: + if delete_pending == 1: yield file_object.vol.offset, delete_pending, None @classmethod @@ -158,7 +158,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ) if not has_imagefilepointer: vollog.warning( - "ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present" + "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present" ) for proc in procs: