From 12fe297c80980cb7cb18789251f3dc6d9a279aa2 Mon Sep 17 00:00:00 2001
From: Michael Ligh <mligh@volexity.com>
Date: Wed, 6 Feb 2019 20:26:47 -0600
Subject: [PATCH] builtin_constraints() returns all constraints by default

---
 .../framework/plugins/windows/poolscanner.py  | 22 ++++++++++---------
 .../framework/plugins/windows/psscan.py       |  2 +-
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py
index 4b2c60689..612119efe 100644
--- a/volatility/framework/plugins/windows/poolscanner.py
+++ b/volatility/framework/plugins/windows/poolscanner.py
@@ -141,13 +141,7 @@ class PoolScanner(plugins.PluginInterface):
     def _generator(self):
 
         symbol_table = self.config["nt_symbols"]
-        constraints = self.builtin_constraints(symbol_table, [
-            b'AtmT',
-            b'Pro\xe3',
-            b'Proc',
-            b'Fil\xe5',
-            b'File',
-        ])
+        constraints = self.builtin_constraints(symbol_table)
 
         for constraint, mem_object, header in self.generate_pool_scan(self.context,
                                                                       self.config["primary"],
@@ -169,8 +163,13 @@ class PoolScanner(plugins.PluginInterface):
             yield (0, (constraint.type_name, format_hints.Hex(header.vol.offset), header.vol.layer_name, name))
 
     @staticmethod
-    def builtin_constraints(symbol_table: str, tags: List[bytes]) -> List[PoolConstraint]:
-        """Get built-in PoolConstraints given a list of pool tags"""
+    def builtin_constraints(symbol_table: str, tags_filter: List[bytes] = []) -> List[PoolConstraint]:
+        """Get built-in PoolConstraints given a list of pool tags.
+
+        The tags_filter is a list of pool tags, and the associated
+        PoolConstraints are  returned. If tags_filter is empty or
+        not supplied, then all builtin constraints are returned.
+        """
 
         builtins = [
             # atom tables
@@ -209,7 +208,10 @@ class PoolScanner(plugins.PluginInterface):
                 page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
             ]
 
-        return [constraint for constraint in builtins if constraint.tag in tags]
+        if not tags_filter:
+            return builtins
+
+        return [constraint for constraint in builtins if constraint.tag in tags_filter]
 
     @classmethod
     def generate_pool_scan(cls,
diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py
index 1073c45f9..a4d9a3ce5 100644
--- a/volatility/framework/plugins/windows/psscan.py
+++ b/volatility/framework/plugins/windows/psscan.py
@@ -48,7 +48,7 @@ class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface):
         """Scans for processes using the poolscanner module and constraints"""
 
         constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table,
-                                                                  [b'Pro\xe3', b'Proc',])
+                                                                  [b'Pro\xe3', b'Proc'])
 
         for result in poolscanner.PoolScanner.generate_pool_scan(context,
                                                                  layer_name,