From 02fbb3ce4933349edd90e170515268c23e610bc5 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 15 Apr 2025 10:14:58 -0500
Subject: [PATCH 1/4] Poolscanners: Fix symlink pool types

Fixes regression introduced in #1632

Symbolic links are allocated in the paged pools, not non-paged. This was
causing us to miss symlinks across both pre and post win8 samples.
---
 volatility3/framework/plugins/windows/poolscanner.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py
index 7929b70e4..f62a34962 100644
--- a/volatility3/framework/plugins/windows/poolscanner.py
+++ b/volatility3/framework/plugins/windows/poolscanner.py
@@ -343,7 +343,7 @@ class PoolScanner(plugins.PluginInterface):
                 type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
                 object_type="SymbolicLink",
                 size=(72, None),
-                page_type=PoolType.NONPAGED | PoolType.FREE,
+                page_type=PoolType.PAGED | PoolType.FREE,
             ),
             # symlinks on windows starting with windows 8
             PoolConstraint(
@@ -351,7 +351,7 @@ class PoolScanner(plugins.PluginInterface):
                 type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
                 object_type="SymbolicLink",
                 size=(72, None),
-                page_type=PoolType.NONPAGED | PoolType.FREE,
+                page_type=PoolType.PAGED | PoolType.FREE,
             ),
             # registry hives
             PoolConstraint(

From d745a62d7faa7cb91f2b77ca96b031d09a044b2b Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 15 Apr 2025 10:21:52 -0500
Subject: [PATCH 2/4] PoolScanner: Patch version bump

Bumping the patch version due to bugfix.
---
 volatility3/framework/plugins/windows/poolscanner.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py
index f62a34962..7030b4c9a 100644
--- a/volatility3/framework/plugins/windows/poolscanner.py
+++ b/volatility3/framework/plugins/windows/poolscanner.py
@@ -131,7 +131,7 @@ class PoolScanner(plugins.PluginInterface):
     """A generic pool scanner plugin."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (3, 0, 0)
+    _version = (3, 0, 1)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

From 32e9cee6dd64f41145d723f0a864548d995d5fc7 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 15 Apr 2025 10:43:12 -0500
Subject: [PATCH 3/4] Tests: Add Symlinkscan generic test

This should be enough to prevent serious regressions that break all
output.
---
 test/plugins/windows/windows.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py
index 6733d543e..0db3aa35b 100644
--- a/test/plugins/windows/windows.py
+++ b/test/plugins/windows/windows.py
@@ -746,6 +746,19 @@ class TestWindowsKPCRs:
         assert test_volatility.count_entries_flat(json.loads(out)) > 0
 
 
+class TestWindowsSymlinkScan:
+    def test_windows_generic_symlinkscan(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.symlinkscan.SymlinkScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        assert test_volatility.count_entries_flat(json.loads(out)) > 0
+
+
 class TestWindowsLdrModules:
     def test_windows_specific_ldrmodules(self, volatility, python):
         image = WindowsSamples.WINDOWSXP_GENERIC.value.path

From 2199375dd52af3913eb4abf7fe5e05ac6c625941 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 15 Apr 2025 10:48:49 -0500
Subject: [PATCH 4/4] Tests: Add symlinkscan specific test

---
 test/plugins/windows/windows.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py
index 0db3aa35b..4272b64d2 100644
--- a/test/plugins/windows/windows.py
+++ b/test/plugins/windows/windows.py
@@ -758,6 +758,38 @@ class TestWindowsSymlinkScan:
         assert rc == 0
         assert test_volatility.count_entries_flat(json.loads(out)) > 0
 
+    def test_windows_specific_symlinkscan(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.symlinkscan.SymlinkScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 5
+        expected_rows = [
+            {
+              "CreateTime": "2005-06-25T16:47:28+00:00",
+              "From Name": "AUX",
+              "Offset": 453082584,
+              "To Name": "\\DosDevices\\COM1",
+              "__children": []
+            },
+            {
+              "CreateTime": "2005-06-25T16:47:28+00:00",
+              "From Name": "UNC",
+              "Offset": 453176664,
+              "To Name": "\\Device\\Mup",
+              "__children": []
+            }
+        ]
+
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
 
 class TestWindowsLdrModules:
     def test_windows_specific_ldrmodules(self, volatility, python):