From c6c501ecb57e1757a510d019a3752af78dda96cc Mon Sep 17 00:00:00 2001
From: RuBublik <relikr@gmail.com>
Date: Mon, 22 May 2023 15:31:25 +0300
Subject: [PATCH] implemented generate_timeline method in ThrdScan

---
 .../framework/plugins/windows/thrdscan.py     | 36 ++++++++++++++++---
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py
index 8b445991f..ca3f4fc69 100644
--- a/volatility3/framework/plugins/windows/thrdscan.py
+++ b/volatility3/framework/plugins/windows/thrdscan.py
@@ -9,15 +9,16 @@ from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.renderers import format_hints
 from volatility3.plugins.windows import poolscanner
+from volatility3.plugins import timeliner
 
 vollog = logging.getLogger(__name__)
 
 
-class ThrdScan(interfaces.plugins.PluginInterface):
+class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for windows threads."""
 
     # cuz installed Framework interface version 2
-    _required_framework_version = (2, 0, 0)     
+    _required_framework_version = (2, 0, 0)  
 
     @classmethod
     def get_requirements(cls):
@@ -93,15 +94,40 @@ class ThrdScan(interfaces.plugins.PluginInterface):
                 )
             )
 
+    def generate_timeline(self):
+        for row in self._generator():
+            _depth, row_data = row
+            row_dict = {}
+            (
+                row_dict["Offset"],
+                row_dict["PID"],
+                row_dict["TID"],
+                row_dict["StartAddress"],
+                row_dict["CreateTime"],
+                row_dict["ExitTime"],
+            ) = row_data
+
+            # Skip threads with no creation time
+            # - mainly system process threads
+            if not isinstance(row_dict["CreateTime"], datetime.datetime):
+                continue
+            description = (f"Thread: Tid {row_dict['TID']} in Pid {row_dict['PID']} (Offset {row_dict['Offset']})")
+            
+            # yield created time, and if there is exit time, yield it too.
+            yield (description, timeliner.TimeLinerType.CREATED, row_dict["CreateTime"])
+            if isinstance(row_dict["ExitTime"], datetime.datetime):
+                yield (description, timeliner.TimeLinerType.MODIFIED, row_dict["ExitTime"])           
+
+
     def run(self):
         return renderers.TreeGrid(
             [
                 ("Offset", format_hints.Hex),
                 ("PID", int),
                 ("TID", int),
-                ("Start Address", format_hints.Hex),
-                ("Create Time", datetime.datetime),
-                ("Exit Time", datetime.datetime),
+                ("StartAddress", format_hints.Hex),
+                ("CreateTime", datetime.datetime),
+                ("ExitTime", datetime.datetime),
             ],
             self._generator(),
         )
\ No newline at end of file