mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-26 16:12:23 +02:00
Thrdscan: Remove filtering based on VAD count
This was preventing enumeration of valid processes (confirmed by disassembly of the start address/Win32 start address). Heuristic-based filtering should probably be left to consumers of the APIs.
This commit is contained in:
@@ -119,11 +119,6 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
|
||||
vads = pe_symbols.PESymbols.get_vads_for_process_cache(
|
||||
vads_cache, owner_proc
|
||||
)
|
||||
if not vads or len(vads) < 5:
|
||||
vollog.debug(
|
||||
f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
|
||||
)
|
||||
return None
|
||||
|
||||
start_path = pe_symbols.PESymbols.filepath_for_address(
|
||||
vads, thread_start_addr
|
||||
|
||||
Reference in New Issue
Block a user