From a6d8ba8bfaeeceebd564e35e84ae0e288f69871e Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 15 Jul 2024 20:22:40 +1000 Subject: [PATCH] windows eprocess validation: Make the creation and exit year checks dynamic --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ae855d6c6..93c19599e 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -614,12 +614,13 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): # A process must have a creation time return False - if not (1998 < ctime.year < 2030): + current_year = datetime.datetime.now().year + if not (1998 < ctime.year < current_year + 10): return False etime = self.get_exit_time() if isinstance(etime, datetime.datetime): - if not (1998 < etime.year < 2030): + if not (1998 < etime.year < current_year + 10): return False # Exit time, if available, must be after the creation time