In Linux kernels 6.7 (https://github.com/torvalds/linux/commit/8e1f385104ac044f1552686ad6e1cbc71cc05a30 ) the task_struct's thread_group member was removed. The changes in this PR allow to fetch task threads from the signal handlers . This will work from kernel 3.14 when the thread_head was added to the signal_struct. This is also how the kernel obtains the task threads since then. Otherwise, it will use the previous method via the thread_group member.
This fix revives all plugins that enumerate threads when running with kernels 6.7 and above.
Before:
$ python3 ./vol.py \
-f ./dump_ubuntu2404amd64_6.8.0-41-generic.core \
linux.pslist --threads
Volatility 3 Framework 2.11.0
OFFSET (V) PID TID PPID COMM File output
0x981e8130a900 1 1 0 systemd DisabledTraceback (most recent call last):
...
File "/home/user/vol3_fix_pslist_thread_group/volatility3/framework/symbols/linux/extensions/__init__.py", line 372, in get_threads
for task in self.thread_group.to_list(
File "/home/user/vol3_fix_pslist_thread_group/volatility3/framework/objects/__init__.py", line 969, in __getattr__
raise AttributeError(
AttributeError: StructType has no attribute: symbol_table_name1!task_struct.thread_group
In Linux kernels 6.7 (https://github.com/torvalds/linux/commit/8e1f385104ac044f1552686ad6e1cbc71cc05a30 ) the task_struct's
thread_groupmember was removed. The changes in this PR allow to fetch task threads from the signal handlers . This will work from kernel 3.14 when thethread_headwas added to thesignal_struct. This is also how the kernel obtains the task threads since then. Otherwise, it will use the previous method via thethread_groupmember. This fix revives all plugins that enumerate threads when running with kernels 6.7 and above.Before:
After: