WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-03 04:38:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Address feedback

Browse Source
This commit is contained in:
Andrew Case
2025-02-14 20:42:00 +00:00
parent 9b78099a08
commit 92db0e3f08
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/modules.py
+3 -3
View File
@@ -18,7 +18,7 @@ class Modules(interfaces.plugins.PluginInterface):
"""Lists the loaded kernel modules."""
_required_framework_version = (2, 0, 0)
_version = (2, 0, 2)
_version = (2, 1, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
@@ -128,7 +128,7 @@ class Modules(interfaces.plugins.PluginInterface):
)
@classmethod
def get_kernel_space_start(cls, context, layer_name: str, module_name: str) -> int:
def get_kernel_space_start(cls, context, module_name: str) -> int:
"""
Returns the starting address of the kernel address space
@@ -149,7 +149,7 @@ class Modules(interfaces.plugins.PluginInterface):
object_type=object_type, offset=range_start_offset
)
layer = context.layers[layer_name]
layer = context.layers[module.layer_name]
return kernel_space_start & layer.address_mask
volatility3/framework/plugins/windows/orphan_kernel_threads.py
+2 -2
View File
@@ -38,7 +38,7 @@ class Threads(thrdscan.ThrdScan):
name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
),
requirements.PluginRequirement(
name="modules", plugin=modules.Modules, version=(2, 0, 2)
name="modules", plugin=modules.Modules, version=(2, 1, 0)
),
]
@@ -66,7 +66,7 @@ class Threads(thrdscan.ThrdScan):
)
kernel_space_start = modules.Modules.get_kernel_space_start(
context, layer_name, module_name
context, module_name
)
for thread in thrdscan.ThrdScan.scan_threads(context, module_name):