diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 4bcab7229..42cd0bf71 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -14,6 +14,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): # Set-up windows specific types self.set_type_class('_ETHREAD', extensions.ETHREAD) + self.set_type_class('_KTHREAD', extensions.KTHREAD) self.set_type_class('_LIST_ENTRY', extensions.LIST_ENTRY) self.set_type_class('_EPROCESS', extensions.EPROCESS) self.set_type_class('_UNICODE_STRING', extensions.UNICODE_STRING)