From 444305afc2cbf680a6097b7b9c17fd7be97d1ca3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:55:48 +0000 Subject: [PATCH] Handle kernel processes properly this time --- volatility3/framework/plugins/windows/thrdscan.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 387125899..0ac3d0c33 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -110,13 +110,12 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None - if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4: - vollog.debug( - f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}" - ) - return None - - if vads_cache is not None: + # don't look for VADs in kernel threads, just let them get reported with empty paths + if ( + owner_proc_pid != 4 + and owner_proc.InheritedFromUniqueProcessId != 4 + and vads_cache is not None + ): vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc )