volatility.plugins.malware.threads.DkomExit Class Reference

Detect inconsistencies wrt exit times and termination. More...

Inheritance diagram for volatility.plugins.malware.threads.DkomExit:

Public Member Functions
def	check (self)
	This check is True when a thread's ExitTime is non-zero (indicating it has exited) but the state and flags indicate that it is still active. More...
Public Member Functions inherited from volatility.plugins.malware.threads.AbstractThreadCheck
def	__init__ (self, thread, mods, mod_addrs, hooked_tables, found_by_scanner)
def	check (self)
	Return True or False from this method.

Additional Inherited Members
Public Attributes inherited from volatility.plugins.malware.threads.AbstractThreadCheck
	thread
	mods
	mod_addrs
	hooked_tables
	found_by_scanner
	flags

Detailed Description

Detect inconsistencies wrt exit times and termination.

Member Function Documentation

def volatility.plugins.malware.threads.DkomExit.check

(

self

)

This check is True when a thread's ExitTime is non-zero (indicating it has exited) but the state and flags indicate that it is still active.

---

The documentation for this class was generated from the following file:

• volatility/plugins/malware/threads.py