From 7d5d379144ce1a34a4346b6068e0008987b66407 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 21:24:55 +0000 Subject: [PATCH 1/3] Allow desktops and window stations to come from the paged or non-paged pool --- volatility3/framework/plugins/windows/poolscanner.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 7dd6821b8..1f29a3aed 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -194,14 +194,14 @@ class PoolScanner(plugins.PluginInterface): b"Wind", type_name=gui_table + constants.BANG + "tagWINDOWSTATION", size=(0x90, None), - page_type=PoolType.PAGED, + page_type=PoolType.PAGED | PoolType.NONPAGED, object_type="WindowStation", skip_type_test=True, ), PoolConstraint( b"Desk", type_name=gui_table + constants.BANG + "tagDESKTOP", - page_type=PoolType.PAGED, + page_type=PoolType.PAGED | PoolType.NONPAGED, object_type="Desktop", skip_type_test=True, ),