WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: ThreadsProcess for windows older version

Browse Source
This commit is contained in:
Donghyun Kim
2022-05-10 12:29:36 +09:00
parent b0e0f20966
commit f4dd582f15
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+6 -1
View File
@@ -450,7 +450,12 @@ class ETHREAD(objects.StructType):
def owning_process(self) -> interfaces.objects.ObjectInterface:
"""Return the EPROCESS that owns this thread."""
return self.Tcb.Process.dereference().cast("_EPROCESS")
if(self.has_member("ThreadsProcess")):
return self.ThreadsProcess.dereference().cast("_EPROCESS")
elif(self.has_member("Tcb") and self.Tcb.has_member("Process")):
return self.Tcb.Process.dereference().cast("_EPROCESS")
else:
raise AttributeError("Unable to find the owning process of ethread")
def get_cross_thread_flags(self) -> str:
dictCrossThreadFlags = {