From 14c11b24f6af44f627bc276c76b2b53d852724fa Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 2 May 2022 14:33:35 +0100 Subject: [PATCH] Symbols: Make _IMAGE_NT_HEADERS optional since not all Windows versions contain it --- volatility3/framework/symbols/windows/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py index b5129bb04..899b89dc2 100755 --- a/volatility3/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -39,9 +39,9 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('_VACB', extensions.VACB) self.set_type_class('_POOL_TRACKER_BIG_PAGES', pool.POOL_TRACKER_BIG_PAGES) self.set_type_class('_IMAGE_DOS_HEADER', pe.IMAGE_DOS_HEADER) - self.set_type_class('_IMAGE_NT_HEADERS', pe.IMAGE_NT_HEADERS) - # Might not exist in 32-bit operating systems. + # Might not necessarily defined in every version of windows + self.optional_set_type_class('_IMAGE_NT_HEADERS', pe.IMAGE_NT_HEADERS) self.optional_set_type_class('_IMAGE_NT_HEADERS64', pe.IMAGE_NT_HEADERS) # This doesn't exist in very specific versions of windows