From 489dd0cf77bd5bea1d1d502084adf30655a3d250 Mon Sep 17 00:00:00 2001 From: memoryforensics1 <61626429+memoryforensics1@users.noreply.github.com> Date: Tue, 1 Sep 2020 17:38:02 +0300 Subject: [PATCH] add KTHREAD struct --- volatility/framework/symbols/windows/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 4bcab7229..42cd0bf71 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -14,6 +14,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): # Set-up windows specific types self.set_type_class('_ETHREAD', extensions.ETHREAD) + self.set_type_class('_KTHREAD', extensions.KTHREAD) self.set_type_class('_LIST_ENTRY', extensions.LIST_ENTRY) self.set_type_class('_EPROCESS', extensions.EPROCESS) self.set_type_class('_UNICODE_STRING', extensions.UNICODE_STRING)