diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index 6b5b9846a..77872e063 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -88,24 +88,6 @@ class OsDistinguisher: return True -is_windows_8_1_or_later = OsDistinguisher( - version_check=lambda x: x >= (6, 3), - fallback_checks=[("_KPRCB", "PendingTickFlags", True)], -) - -is_vista_or_later = OsDistinguisher( - version_check=lambda x: x >= (6, 0), - fallback_checks=[("KdCopyDataBlock", None, True)], -) - -is_win10 = OsDistinguisher( - version_check=lambda x: (10, 0) <= x, - fallback_checks=[ - ("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ], -) - is_windows_xp = OsDistinguisher( version_check=lambda x: (5, 1) <= x < (5, 2), fallback_checks=[ @@ -149,6 +131,32 @@ is_2003 = OsDistinguisher( ], ) +is_vista_or_later = OsDistinguisher( + version_check=lambda x: x >= (6, 0), + fallback_checks=[("KdCopyDataBlock", None, True)], +) + +is_windows_8_1_or_later = OsDistinguisher( + version_check=lambda x: x >= (6, 3), + fallback_checks=[("_KPRCB", "PendingTickFlags", True)], +) + +is_win10 = OsDistinguisher( + version_check=lambda x: (10, 0) <= x, + fallback_checks=[ + ("ObHeaderCookie", None, True), + ("_HANDLE_TABLE", "HandleCount", False), + ], +) + +is_win10_10586_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 10586), + fallback_checks=[ + ("_EPROCESS", "SecurityDomain", False), + ("_EPROCESS", "ImageFilePointer", False), + ], +) + is_win10_up_to_15063 = OsDistinguisher( version_check=lambda x: (10, 0) <= x < (10, 0, 15063), fallback_checks=[ @@ -195,14 +203,6 @@ is_win10_17134_or_later = OsDistinguisher( ], ) -is_win10_10586_or_later = OsDistinguisher( - version_check=lambda x: x >= (10, 0, 10586), - fallback_checks=[ - ("_EPROCESS", "SecurityDomain", False), - ("_EPROCESS", "ImageFilePointer", False), - ], -) - is_win10_17763_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 17763), fallback_checks=[