From d69b231f16173681199521365cdfaed11ed59282 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:44:49 -0600 Subject: [PATCH] Windows Suspended Threads: Updates pe_symbols req This bumps the requirement version number for pe_symbols, and uses the latest method signature. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index cec51ed37..1ecdf0c51 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -33,7 +33,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(2, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), requirements.VersionRequirement( name="threads", component=threads.Threads, version=(1, 0, 0) @@ -96,7 +96,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): # will not have suspended threads if not proc_modules: proc_modules = pe_symbols.PESymbols.get_process_modules( - self.context, kernel.layer_name, kernel.symbol_table_name, None + self.context, self.config["kernel"], None ) path_and_symbol = functools.partial(