From 537efa60e28d0a9ad23c5b0017618c853f338441 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 13:24:59 -0500 Subject: [PATCH] Thrdscan: Remove filtering based on VAD count This was preventing enumeration of valid processes (confirmed by disassembly of the start address/Win32 start address). Heuristic-based filtering should probably be left to consumers of the APIs. --- volatility3/framework/plugins/windows/thrdscan.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 0ac3d0c33..8fe13ba64 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -119,11 +119,6 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - if not vads or len(vads) < 5: - vollog.debug( - f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" - ) - return None start_path = pe_symbols.PESymbols.filepath_for_address( vads, thread_start_addr