diff --git a/volatility/framework/constants/windows/__init__.py b/volatility/framework/constants/windows/__init__.py new file mode 100644 index 000000000..1aca969bb --- /dev/null +++ b/volatility/framework/constants/windows/__init__.py @@ -0,0 +1,5 @@ +"""Volatility 3 Linux Constants + +Windows-specific values that aren't found in debug symbols""" + +KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"]