diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5364fcbda..24260a798 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -517,6 +517,15 @@ class task_struct(generic.GenericIntelProcess): else None ) + @property + def state(self): + if self.has_member("__state"): + return self.member("__state") + elif self.has_member("state"): + return self.member("state") + else: + raise AttributeError("Unsupported task_struct: Cannot find state") + def _get_task_start_time(self) -> datetime.timedelta: """Returns the task's monotonic start_time as a timedelta.