From 105816beeb2267acfc41092e7fb3e7496e8d800d Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 2 Aug 2018 10:59:14 +0100
Subject: [PATCH] Add in Windows specific constants for kernel modules (whose
 symbol tables are loaded by automagic).

---
 volatility/framework/constants/windows/__init__.py | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 volatility/framework/constants/windows/__init__.py

diff --git a/volatility/framework/constants/windows/__init__.py b/volatility/framework/constants/windows/__init__.py
new file mode 100644
index 000000000..1aca969bb
--- /dev/null
+++ b/volatility/framework/constants/windows/__init__.py
@@ -0,0 +1,5 @@
+"""Volatility 3 Linux Constants
+
+Windows-specific values that aren't found in debug symbols"""
+
+KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"]