WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix checks in thrdscan that broke tests

Browse Source
This commit is contained in:
Andrew Case
2025-03-26 00:41:26 +00:00
parent 2ebda44482
commit e52aea886e
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/thrdscan.py
+8 -7
View File
@@ -110,18 +110,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}")
return None
if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4:
vollog.debug(
f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}"
)
return None
if vads_cache is not None:
vads = pe_symbols.PESymbols.get_vads_for_process_cache(
vads_cache, owner_proc
)
# no vads = terminated/smeared, pid 4 = kernel = don't check VADs
if (
owner_proc_pid != 4
and owner_proc.InheritedFromUniqueProcessId != 4
and (not vads or len(vads) < 5)
):
if not vads or len(vads) < 5:
vollog.debug(
f"No vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
)
return None