From 1082429aab87bc13e482d133f6cd355db856404e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 17 Aug 2019 23:20:46 +0100 Subject: [PATCH] Don't use a separate symbol table class just to add a class override. --- volatility/framework/plugins/windows/poolscanner.py | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index 52ec3cf1e..d697ade71 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -45,13 +45,6 @@ class PoolType(enum.IntEnum): FREE = 4 -class PoolHeaderSymbolTable(intermed.IntermediateSymbolTable): - - def __init__(self, *args, **kwargs) -> None: - super().__init__(*args, **kwargs) - self.set_type_class('_POOL_HEADER', extensions._POOL_HEADER) - - class PoolConstraint: """Class to maintain tag/size/index/type information about Pool header tags""" @@ -415,7 +408,8 @@ class PoolScanner(plugins.PluginInterface): config_path = configuration.path_join(context.symbol_space[symbol_table].config_path, "poolheader"), sub_path = "windows", filename = pool_header_json_filename, - table_mapping = {'nt_symbols': symbol_table}) + table_mapping = {'nt_symbols': symbol_table}, + class_types = {'_POOL_HEADER', extensions._POOL_HEADER}) module = context.module(new_table_name, layer_name, offset = 0) return module