From 8a3ee4f0b79cd08220fdcb40141fbe6313c28a98 Mon Sep 17 00:00:00 2001 From: memoryforensics1 <61626429+memoryforensics1@users.noreply.github.com> Date: Tue, 1 Sep 2020 16:27:09 +0300 Subject: [PATCH] add token object _TOKEN struct added --- volatility/framework/symbols/windows/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index d932767fc..4bcab7229 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -18,6 +18,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('_EPROCESS', extensions.EPROCESS) self.set_type_class('_UNICODE_STRING', extensions.UNICODE_STRING) self.set_type_class('_EX_FAST_REF', extensions.EX_FAST_REF) + self.set_type_class('_TOKEN', extensions.TOKEN) self.set_type_class('_OBJECT_HEADER', pool.OBJECT_HEADER) self.set_type_class('_FILE_OBJECT', extensions.FILE_OBJECT) self.set_type_class('_DEVICE_OBJECT', extensions.DEVICE_OBJECT)