From 92db0e3f08006501f37ea1ae3379f7382d025efa Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Feb 2025 20:42:00 +0000 Subject: [PATCH] Address feedback --- volatility3/framework/plugins/windows/modules.py | 6 +++--- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 75b15217a..a21a87bbd 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -18,7 +18,7 @@ class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 2) + _version = (2, 1, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -128,7 +128,7 @@ class Modules(interfaces.plugins.PluginInterface): ) @classmethod - def get_kernel_space_start(cls, context, layer_name: str, module_name: str) -> int: + def get_kernel_space_start(cls, context, module_name: str) -> int: """ Returns the starting address of the kernel address space @@ -149,7 +149,7 @@ class Modules(interfaces.plugins.PluginInterface): object_type=object_type, offset=range_start_offset ) - layer = context.layers[layer_name] + layer = context.layers[module.layer_name] return kernel_space_start & layer.address_mask diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 7a865c675..18e087553 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -38,7 +38,7 @@ class Threads(thrdscan.ThrdScan): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 2) + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -66,7 +66,7 @@ class Threads(thrdscan.ThrdScan): ) kernel_space_start = modules.Modules.get_kernel_space_start( - context, layer_name, module_name + context, module_name ) for thread in thrdscan.ThrdScan.scan_threads(context, module_name):