Skip to content

Commit 5a71511

Browse files
authored
Merge pull request #1675 from volatilityfoundation/fix_list_threads_api
Update the list_threads API to current standards and update current c…
2 parents 7ac9d02 + 7342f1e commit 5a71511

File tree

4 files changed

+20
-15
lines changed

4 files changed

+20
-15
lines changed

volatility3/framework/plugins/windows/debugregisters.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ def get_requirements(cls) -> List:
3838
name="pslist", component=pslist.PsList, version=(3, 0, 0)
3939
),
4040
requirements.VersionRequirement(
41-
name="threads", component=threads.Threads, version=(2, 0, 0)
41+
name="threads", component=threads.Threads, version=(3, 0, 0)
4242
),
4343
requirements.VersionRequirement(
4444
name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0)
@@ -111,8 +111,6 @@ def _generator(
111111
None,
112112
None,
113113
]:
114-
kernel = self.context.modules[self.config["kernel"]]
115-
116114
vads_cache: Dict[int, pe_symbols.ranges_type] = {}
117115

118116
proc_modules = None
@@ -122,7 +120,9 @@ def _generator(
122120
)
123121

124122
for proc in procs:
125-
for thread in threads.Threads.list_threads(kernel, proc):
123+
for thread in threads.Threads.list_threads(
124+
self.context, self.config["kernel"], proc
125+
):
126126
debug_info = self._get_debug_info(thread)
127127
if not debug_info:
128128
continue

volatility3/framework/plugins/windows/suspended_threads.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ def get_requirements(cls):
3636
name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0)
3737
),
3838
requirements.VersionRequirement(
39-
name="threads", component=threads.Threads, version=(2, 0, 0)
39+
name="threads", component=threads.Threads, version=(3, 0, 0)
4040
),
4141
]
4242

@@ -54,8 +54,6 @@ def _generator(self):
5454
5555
https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf
5656
"""
57-
kernel = self.context.modules[self.config["kernel"]]
58-
5957
vads_cache: Dict[int, pe_symbols.PESymbols.ranges_type] = {}
6058

6159
proc_modules = None
@@ -64,7 +62,9 @@ def _generator(self):
6462
for proc in pslist.PsList.list_processes(
6563
context=self.context, kernel_module_name=self.config["kernel"]
6664
):
67-
for thread in threads.Threads.list_threads(kernel, proc):
65+
for thread in threads.Threads.list_threads(
66+
self.context, self.config["kernel"], proc
67+
):
6868
try:
6969
# we only care if the thread is suspended
7070
if thread.Tcb.SuspendCount == 0:

volatility3/framework/plugins/windows/suspicious_threads.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
4141
name="pslist", component=pslist.PsList, version=(3, 0, 0)
4242
),
4343
requirements.VersionRequirement(
44-
name="threads", component=threads.Threads, version=(2, 0, 0)
44+
name="threads", component=threads.Threads, version=(3, 0, 0)
4545
),
4646
requirements.VersionRequirement(
4747
name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
@@ -169,7 +169,9 @@ def _generator(self):
169169
# there is no benefit to checking the same address more than once per process
170170
checked = set()
171171

172-
for thread in threads.Threads.list_threads(kernel, proc):
172+
for thread in threads.Threads.list_threads(
173+
self.context, self.config["kernel"], proc
174+
):
173175
# do not process if a thread is exited or terminated (4 = Terminated)
174176
if thread.ExitTime.QuadPart > 0 or thread.Tcb.State == 4:
175177
continue

volatility3/framework/plugins/windows/threads.py

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan):
1616
"""Lists process threads"""
1717

1818
_required_framework_version = (2, 4, 0)
19-
_version = (2, 0, 0)
19+
_version = (3, 0, 0)
2020

2121
def __init__(self, *args, **kwargs):
2222
super().__init__(*args, **kwargs)
@@ -38,7 +38,10 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
3838

3939
@classmethod
4040
def list_threads(
41-
cls, kernel, proc: interfaces.objects.ObjectInterface
41+
cls,
42+
context: interfaces.context.ContextInterface,
43+
kernel_module_name: str,
44+
proc: interfaces.objects.ObjectInterface,
4245
) -> Generator[interfaces.objects.ObjectInterface, None, None]:
4346
"""Lists the Threads of a specific process.
4447
@@ -48,6 +51,8 @@ def list_threads(
4851
Returns:
4952
A list of threads based on the process and filtered based on the filter function
5053
"""
54+
kernel = context.modules[kernel_module_name]
55+
5156
seen = set()
5257
for thread in proc.ThreadListHead.to_list(
5358
f"{kernel.symbol_table_name}{constants.BANG}_ETHREAD", "ThreadListEntry"
@@ -64,13 +69,11 @@ def list_process_threads(
6469
kernel_module_name: str,
6570
) -> Iterable[interfaces.objects.ObjectInterface]:
6671
"""Runs through all processes and lists threads for each process"""
67-
module = context.modules[kernel_module_name]
68-
6972
filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None))
7073

7174
for proc in pslist.PsList.list_processes(
7275
context=context,
7376
kernel_module_name=kernel_module_name,
7477
filter_func=filter_func,
7578
):
76-
yield from cls.list_threads(module, proc)
79+
yield from cls.list_threads(context, kernel_module_name, proc)

0 commit comments

Comments
 (0)