From e0abdd92f2889e3841197573393d87c8c31d2a68 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 13 May 2025 17:52:12 -0500
Subject: [PATCH 1/2] Windows Thrdscan: Fix broken tuple unpacking

Timeliner fails due to an incorrect unpacking of this tuple, which needs
3 additional dictionary items for start path, win32 start path, and
win32 start address.
---
 volatility3/framework/plugins/windows/thrdscan.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py
index d5a1a0b07..082b82284 100644
--- a/volatility3/framework/plugins/windows/thrdscan.py
+++ b/volatility3/framework/plugins/windows/thrdscan.py
@@ -190,6 +190,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
                 row_dict["PID"],
                 row_dict["TID"],
                 row_dict["StartAddress"],
+                row_dict["StartPath"],
+                row_dict["Win32StartAddress"],
+                row_dict["Win32StartPath"],
                 row_dict["CreateTime"],
                 row_dict["ExitTime"],
             ) = row_data

From 90a3829ee766f3ef5530ef061389e7f343ba96b8 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 15 May 2025 17:28:26 -0500
Subject: [PATCH 2/2] Windows Timeliner: Add basic test

This is enough to ensure that the return code is nonzero and there was
some valid output.
---
 test/plugins/windows/windows.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py
index 4272b64d2..0f44ba533 100644
--- a/test/plugins/windows/windows.py
+++ b/test/plugins/windows/windows.py
@@ -58,6 +58,14 @@ class TestWindowsPslist:
         }
         assert test_volatility.match_output_row(expected_row, json.loads(out))
 
+class TestWindowsTimeliner:
+    def test_windows_specific_timeliner(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "timeliner.Timeliner", image, volatility, python
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 10
 
 class TestWindowsPsscan:
     def test_windows_specific_psscan(self, volatility, python):