尝试运行 windows.suspicious_threads.SuspiciousThreads 时出错
在执行时,我遇到了以下错误:
Volatility 3 Framework 2.26.1 进度: 100.00 PDB 扫描完成 进程 PID TID 上下文地址 VAD 路径 说明 Traceback (最新调用最后一条): File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\vol.py", line 11, in volatility3.cli.main() File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\cli_init.py", line 924, in main CommandLine().run() File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\cli_init.py", line 512, in run renderer.render(grid) File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\cli\text_renderer.py", line 330, in render grid.populate(visitor, outfd) File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\framework\renderers_init_.py", line 317, in populate for level, item in self._generator: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\framework\plugins\windows\suspicious_threads.py", line 180, in _generator info = thrdscan.ThrdScan.gather_thread_info(thread) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "C:\Users\DFIR\Downloads\DFIR Tools\volatility3\volatility3\framework\plugins\windows\thrdscan.py", line 116, in gather_thread_info and owner_proc.InheritedFromUniqueProcessId != 4 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AttributeError: 'NoneType' 对象没有属性 'InheritedFromUniqueProcessId'
我的 Python 版本是 Python 3.12.10,我的系统是 Microsoft Windows [Version 10.0.19045.5608]
内容来源: volatilityfoundation/volatility