From 33f3f4372cdfbd044e69768ff684f9e2a85f4b86 Mon Sep 17 00:00:00 2001
From: Michael Ligh <mligh@volexity.com>
Date: Wed, 6 Feb 2019 13:28:18 -0600
Subject: [PATCH] parameterize generate_pool_scan() - let plugins choose which
 contraints to use

plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
---
 .../framework/plugins/windows/poolscanner.py  | 37 ++++++++++++++-----
 .../framework/plugins/windows/psscan.py       |  6 ++-
 2 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py
index 779b698ad..15a15432b 100644
--- a/volatility/framework/plugins/windows/poolscanner.py
+++ b/volatility/framework/plugins/windows/poolscanner.py
@@ -139,9 +139,21 @@ class PoolScanner(plugins.PluginInterface):
                 and not PoolScanner.is_windows_8_or_later(context, layer_name, symbol_table))
 
     def _generator(self):
+
+        symbol_table = self.config["nt_symbols"]
+        constraints = self.builtin_constraints(symbol_table, [
+            b'AtmT',
+            b'Pro\xe3',
+            b'Proc',
+            b'Fil\xe5',
+            b'File',
+        ])
+
         for result in self.generate_pool_scan(self.context,
                                               self.config["primary"],
-                                              self.config["nt_symbols"]):
+                                              symbol_table,
+                                              constraints):
+
             constraint, mem_object, header = result
 
             # generate some type-specific info for sanity checking
@@ -159,14 +171,11 @@ class PoolScanner(plugins.PluginInterface):
 
             yield (0, (constraint.type_name, format_hints.Hex(header.vol.offset), header.vol.layer_name, name))
 
-    @classmethod
-    def generate_pool_scan(cls,
-                           context: interfaces.context.ContextInterface,
-                           layer_name: str,
-                           symbol_table: str) \
-            -> Generator[Tuple[PoolConstraint, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface], None, None]:
+    @staticmethod
+    def builtin_constraints(symbol_table: str, tags: List[bytes]) -> List[PoolConstraint]:
+        """Get built-in PoolConstraints given a list of pool tags"""
 
-        constraints = [
+        builtins = [
             # atom tables
             PoolConstraint(
                 b'AtmT',
@@ -201,7 +210,17 @@ class PoolScanner(plugins.PluginInterface):
                 object_type = "File",
                 size = (150, None),
                 page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
-        ]
+            ]
+
+        return [constraint for constraint in builtins if constraint.tag in tags]
+
+    @classmethod
+    def generate_pool_scan(cls,
+                           context: interfaces.context.ContextInterface,
+                           layer_name: str,
+                           symbol_table: str,
+                           constraints: List[PoolConstraint]) \
+            -> Generator[Tuple[PoolConstraint, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface], None, None]:
 
         # get the object type map
         type_map = handles.Handles.list_objects(
diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py
index f0b5ab182..1073c45f9 100644
--- a/volatility/framework/plugins/windows/psscan.py
+++ b/volatility/framework/plugins/windows/psscan.py
@@ -47,9 +47,13 @@ class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface):
             Iterable[interfaces.objects.ObjectInterface]:
         """Scans for processes using the poolscanner module and constraints"""
 
+        constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table,
+                                                                  [b'Pro\xe3', b'Proc',])
+
         for result in poolscanner.PoolScanner.generate_pool_scan(context,
                                                                  layer_name,
-                                                                 symbol_table):
+                                                                 symbol_table,
+                                                                 constraints):
 
             constraint, mem_object, _header = result
             if constraint.object_type == "Process":