diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 75de8bb95..050a86c58 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -366,8 +366,8 @@ class PoolScanner(plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, - kernel_symbol_table: str, - object_symbol_table: str, + kernel_symbol_table_name: str, + object_symbol_table_name: str, constraints: List[PoolConstraint], ) -> Generator[ Tuple[ @@ -396,18 +396,18 @@ class PoolScanner(plugins.PluginInterface): type_map = handles.Handles.get_type_map( context=context, layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table, + symbol_table=kernel_symbol_table_name, ) cookie = handles.Handles.find_cookie( context=context, layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table, + symbol_table=kernel_symbol_table_name, ) - is_windows_10 = versions.is_windows_10(context, kernel_symbol_table) + is_windows_10 = versions.is_windows_10(context, kernel_symbol_table_name) is_windows_8_or_later = versions.is_windows_8_or_later( - context, kernel_symbol_table + context, kernel_symbol_table_name ) # start off with the primary virtual layer @@ -417,14 +417,18 @@ class PoolScanner(plugins.PluginInterface): if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] - if symbols.symbol_table_is_64bit(context, kernel_symbol_table): + if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name): alignment = 0x10 else: alignment = 8 # scan in the main kernel layer for the object(s) for constraint, header in cls.pool_scan( - context, scan_layer, object_symbol_table, constraints, alignment=alignment + context, + scan_layer, + object_symbol_table_name, + constraints, + alignment=alignment, ): # construct the object in its own layer, using its own types @@ -432,7 +436,7 @@ class PoolScanner(plugins.PluginInterface): constraint=constraint, use_top_down=is_windows_8_or_later, native_layer_name=kernel_layer_name, - kernel_symbol_table=kernel_symbol_table, + kernel_symbol_table=kernel_symbol_table_name, ) for mem_object in mem_objects: