From e52aea886ee49f73061432eed03b8d566f514e8f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:41:26 +0000 Subject: [PATCH 1/3] Fix checks in thrdscan that broke tests --- volatility3/framework/plugins/windows/thrdscan.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 7020a1fa1..387125899 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -110,18 +110,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None + if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4: + vollog.debug( + f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}" + ) + return None + if vads_cache is not None: vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - # no vads = terminated/smeared, pid 4 = kernel = don't check VADs - if ( - owner_proc_pid != 4 - and owner_proc.InheritedFromUniqueProcessId != 4 - and (not vads or len(vads) < 5) - ): + if not vads or len(vads) < 5: vollog.debug( - f"No vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" + f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" ) return None From 43ab95f4c5ea38f182bfe863bd5b425cbd9a70f4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:50:34 +0000 Subject: [PATCH 2/3] Change thrdscan from looking for kernel processes --- test/plugins/windows/windows.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index ce05af0cd..f07c8b20c 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -189,9 +189,9 @@ class TestWindowsThrdscan: "windows.thrdscan.ThrdScan", image, volatility, python ) assert rc == 0 - assert out.find(b"\t4\t8") != -1 - assert out.find(b"\t4\t12") != -1 - assert out.find(b"\t4\t16") != -1 + assert out.find(b"\t1812\t2768\t0x7c810856") != -1 + assert out.find(b"\t840\t2964\t0x7c810856") != -1 + assert out.find(b"\t2536\t2552\t0x7c810856") != -1 class TestWindowsPrivileges: From 444305afc2cbf680a6097b7b9c17fd7be97d1ca3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:55:48 +0000 Subject: [PATCH 3/3] Handle kernel processes properly this time --- volatility3/framework/plugins/windows/thrdscan.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 387125899..0ac3d0c33 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -110,13 +110,12 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None - if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4: - vollog.debug( - f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}" - ) - return None - - if vads_cache is not None: + # don't look for VADs in kernel threads, just let them get reported with empty paths + if ( + owner_proc_pid != 4 + and owner_proc.InheritedFromUniqueProcessId != 4 + and vads_cache is not None + ): vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc )