From 88b32b080340ef9e94c7cab19334e536aadfb6c1 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:32:14 +1100 Subject: [PATCH] linux: task_struct object extension: Add helper to obtain the task state --- .../framework/symbols/linux/extensions/__init__.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5364fcbda..24260a798 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -517,6 +517,15 @@ class task_struct(generic.GenericIntelProcess): else None ) + @property + def state(self): + if self.has_member("__state"): + return self.member("__state") + elif self.has_member("state"): + return self.member("state") + else: + raise AttributeError("Unsupported task_struct: Cannot find state") + def _get_task_start_time(self) -> datetime.timedelta: """Returns the task's monotonic start_time as a timedelta.