diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 2f2249934..1fc1fd6bb 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -28,6 +28,8 @@ class _CMHIVE(objects.Struct): return None + name = helper_name + class _UNICODE_STRING(objects.Struct): @property @@ -38,6 +40,8 @@ class _UNICODE_STRING(objects.Struct): return self.Buffer.dereference().cast("string", max_length = self.Length, errors = "replace", encoding = "utf16") + String = helper_string + class _EPROCESS(generic.GenericIntelProcess): def add_process_layer(self, context, config_prefix = None, preferred_name = None):