Thrdscan: Remove filtering based on VAD count

This was preventing enumeration of valid processes (confirmed by
disassembly of the start address/Win32 start address). Heuristic-based
filtering should probably be left to consumers of the APIs.
This commit is contained in:
David McDonald
2025-04-15 13:39:58 -05:00
parent 1ab8ddcb7f
commit 537efa60e2
@@ -119,11 +119,6 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
vads = pe_symbols.PESymbols.get_vads_for_process_cache(
vads_cache, owner_proc
)
if not vads or len(vads) < 5:
vollog.debug(
f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
)
return None
start_path = pe_symbols.PESymbols.filepath_for_address(
vads, thread_start_addr