From 78eb31014b0a97145582d8ae4beef598c2659b1f Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 2 May 2022 00:00:33 +0900 Subject: [PATCH] Fix: get owning process method from _ETHREAD --- volatility3/framework/symbols/windows/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 7d083fbba..fd5e075da 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -448,9 +448,9 @@ class KMUTANT(objects.StructType, pool.ExecutiveObject): class ETHREAD(objects.StructType): """A class for executive thread objects.""" - def owning_process(self, kernel_layer: str = None) -> interfaces.objects.ObjectInterface: + def owning_process(self) -> interfaces.objects.ObjectInterface: """Return the EPROCESS that owns this thread.""" - return self.ThreadsProcess.dereference(kernel_layer) + return self.Tcb.Process.dereference().cast("_EPROCESS") def get_cross_thread_flags(self) -> str: dictCrossThreadFlags = {