WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1739 from volatilityfoundation/fix_thrdscan_checks

Browse Source 
Fix checks in thrdscan that broke tests
This commit is contained in:
ikelos
2025-03-26 00:55:32 +00:00
committed by GitHub
parent 2ebda44482 444305afc2
commit 4fd0f20ff9
2 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/plugins/windows/windows.py
+3 -3
View File
@@ -189,9 +189,9 @@ class TestWindowsThrdscan:
"windows.thrdscan.ThrdScan", image, volatility, python
)
assert rc == 0
assert out.find(b"\t4\t8") != -1
assert out.find(b"\t4\t12") != -1
assert out.find(b"\t4\t16") != -1
assert out.find(b"\t1812\t2768\t0x7c810856") != -1
assert out.find(b"\t840\t2964\t0x7c810856") != -1
assert out.find(b"\t2536\t2552\t0x7c810856") != -1
class TestWindowsPrivileges:
volatility3/framework/plugins/windows/thrdscan.py
+8 -8
View File
@@ -110,18 +110,18 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}")
return None
if vads_cache is not None:
# don't look for VADs in kernel threads, just let them get reported with empty paths
if (
owner_proc_pid != 4
and owner_proc.InheritedFromUniqueProcessId != 4
and vads_cache is not None
):
vads = pe_symbols.PESymbols.get_vads_for_process_cache(
vads_cache, owner_proc
)
# no vads = terminated/smeared, pid 4 = kernel = don't check VADs
if (
owner_proc_pid != 4
and owner_proc.InheritedFromUniqueProcessId != 4
and (not vads or len(vads) < 5)
):
if not vads or len(vads) < 5:
vollog.debug(
f"No vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
)
return None