diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 1ebcf9dc2..8fe1127e3 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -70,7 +70,10 @@ class _POOL_HEADER(objects.Struct): # otherwise we have an executive object in the pool else: - alignment = pool_header_size + if symbols.symbol_table_is_64bit(self._context, symbol_table_name): + alignment = 16 + else: + alignment = 8 # FIXME: calculate and cache this max_optional_headers_length = 0x60