Change pending checking and OS version

atcuno · atcuno · commit 3a4e62285470 · 2025-03-24T20:19:59.000-05:00
diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py
@@ -99,7 +99,7 @@ def _vad_checks(
         except exceptions.InvalidAddressException:
             delete_pending = None
 
-        if delete_pending and delete_pending == 1:
+        if delete_pending == 1:
             yield file_object.vol.offset, delete_pending, None
 
     @classmethod
@@ -158,7 +158,7 @@ def _generator(self, procs):
         )
         if not has_imagefilepointer:
             vollog.warning(
-                "ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present"
+                "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present"
             )
 
         for proc in procs:

Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ def _vad_checks(`
`99`	`99`	`except exceptions.InvalidAddressException:`
`100`	`100`	`delete_pending = None`
`101`	`101`
`102`		`- if delete_pending and delete_pending == 1:`
	`102`	`+ if delete_pending == 1:`
`103`	`103`	`yield file_object.vol.offset, delete_pending, None`
`104`	`104`
`105`	`105`	`@classmethod`
`@@ -158,7 +158,7 @@ def _generator(self, procs):`
`158`	`158`	`)`
`159`	`159`	`if not has_imagefilepointer:`
`160`	`160`	`vollog.warning(`
`161`		`- "ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present"`
	`161`	`+ "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present"`
`162`	`162`	`)`
`163`	`163`
`164`	`164`	`for proc in procs:`