From 68903c63df92c2726fb9cfe75f902ada808a1d30 Mon Sep 17 00:00:00 2001 From: Samuel Zurowski Date: Sun, 6 Mar 2022 20:20:24 -0500 Subject: [PATCH] Added task_struct function to get each task_struct from the thread_nodes structure --- .../symbols/linux/extensions/__init__.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0edd60608..b48027bf5 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -201,6 +201,24 @@ class task_struct(generic.GenericIntelProcess): yield (start, end - start) + def get_thread_nodes(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Returns a list of the task_struct based on the list_head + thread_node structure.""" + + task_symbol_table_name = self.get_symbol_table_name() + + parent = self.group_leader + for task in self.thread_node.to_list( + f"{task_symbol_table_name}{constants.BANG}task_struct", + "thread_node" + ): + + if task.group_leader != parent: continue + + yield task + + + class fs_struct(objects.StructType):