WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 04:24:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: get owning process method from _ETHREAD

Browse Source
This commit is contained in:
Donghyun Kim
2022-05-02 00:00:33 +09:00
parent 8ac2b6ac89
commit 78eb31014b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+2 -2
View File
@@ -448,9 +448,9 @@ class KMUTANT(objects.StructType, pool.ExecutiveObject):
class ETHREAD(objects.StructType):
"""A class for executive thread objects."""
def owning_process(self, kernel_layer: str = None) -> interfaces.objects.ObjectInterface:
def owning_process(self) -> interfaces.objects.ObjectInterface:
"""Return the EPROCESS that owns this thread."""
return self.ThreadsProcess.dereference(kernel_layer)
return self.Tcb.Process.dereference().cast("_EPROCESS")
def get_cross_thread_flags(self) -> str:
dictCrossThreadFlags = {