From 7e00f2c4c409bcdb08b20dc89e8b8b501ee14e02 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 5 Mar 2025 17:42:09 -0600 Subject: [PATCH] Windows Versions: Fix broken OSDistinguisher Something happened when picking _EPROCESS members before that caused this to not function properly. This one relies on a more stable type removal instead of _EPROCESS members. --- volatility3/framework/symbols/windows/versions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index b00892cbc..28b7edfdf 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -152,8 +152,8 @@ is_win10 = OsDistinguisher( is_win10_10586_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 10586), fallback_checks=[ - ("_EPROCESS", "SecurityDomain", False), - ("_EPROCESS", "ImageFilePointer", False), + ("_UNLOADED_DRIVERS", None, False), + ("ObHeaderCookie", None, True), ], )