Skip to content

Commit 537efa6

Browse files
committed
Thrdscan: Remove filtering based on VAD count
This was preventing enumeration of valid processes (confirmed by disassembly of the start address/Win32 start address). Heuristic-based filtering should probably be left to consumers of the APIs.
1 parent 1ab8ddc commit 537efa6

File tree

1 file changed

+0
-5
lines changed

1 file changed

+0
-5
lines changed

volatility3/framework/plugins/windows/thrdscan.py

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -119,11 +119,6 @@ def gather_thread_info(
119119
vads = pe_symbols.PESymbols.get_vads_for_process_cache(
120120
vads_cache, owner_proc
121121
)
122-
if not vads or len(vads) < 5:
123-
vollog.debug(
124-
f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}"
125-
)
126-
return None
127122

128123
start_path = pe_symbols.PESymbols.filepath_for_address(
129124
vads, thread_start_addr

0 commit comments

Comments
 (0)