WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Poolscanners: Fix symlink pool types

Browse Source 
Fixes regression introduced in #1632

Symbolic links are allocated in the paged pools, not non-paged. This was
causing us to miss symlinks across both pre and post win8 samples.
This commit is contained in:
David McDonald
2025-04-15 10:14:58 -05:00
parent df03d2220a
commit 02fbb3ce49
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/poolscanner.py
+2 -2
View File
@@ -343,7 +343,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
object_type="SymbolicLink",
size=(72, None),
page_type=PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.PAGED | PoolType.FREE,
),
# symlinks on windows starting with windows 8
PoolConstraint(
@@ -351,7 +351,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
object_type="SymbolicLink",
size=(72, None),
page_type=PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.PAGED | PoolType.FREE,
),
# registry hives
PoolConstraint(