WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

added 'PoolConstraint' of Thread objects to 'PoolScanner.default_constraints' as part of adding support for thread pool tag scanning

Browse Source
This commit is contained in:
RuBublik
2023-05-17 21:41:37 +03:00
parent 8e56cb39d1
commit 7469872c8b
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/poolscanner.py
+14
View File
@@ -224,6 +224,20 @@ class PoolScanner(plugins.PluginInterface):
size=(600, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
),
# threads on windows before windows8
PoolConstraint(b'Thr\xe5', # -> “protected” allocation, MSB is set.
type_name = symbol_table + constants.BANG + "_ETHREAD",
object_type="Thread",
size = (600, None), # -> 0x0258 - size of strcut in win5.1
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE
),
# threads on windows starting with windows8
PoolConstraint(b'Thre',
type_name = symbol_table + constants.BANG + "_ETHREAD",
object_type="Thread",
size = (600, None), # -> 0x0258 - size of strcut in win5.1
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE
),
# files on windows before windows 8
PoolConstraint(
b"Fil\xe5",