WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 11:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

add the pool header json files to be used when kernels fail to define their own _POOL_HEADER

Browse Source
This commit is contained in:
Michael Ligh
2018-10-03 17:07:07 -05:00
parent 09f12a2126
commit 97ae236fcc
3 changed files with 219 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/poolheader-x64-win7.json
+73
View File
@@ -0,0 +1,73 @@
{
"metadata": {
"producer": {
"version": "0.1.5",
"name": "mhl-by-hand",
"datetime": "2018-10-03T16:53:00.478000"
},
"format": "4.0.0"
},
"user_types": {
"_POOL_HEADER": {
"fields": {
"BlockSize": {
"offset": 0,
"type": {
"bit_length": 8,
"bit_position": 16,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned long"
}
}
},
"PoolIndex": {
"offset": 0,
"type": {
"bit_length": 8,
"bit_position": 8,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned long"
}
}
},
"PoolTag": {
"offset": 4,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"PoolType": {
"offset": 0,
"type": {
"bit_length": 8,
"bit_position": 24,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned long"
}
}
}
},
"kind": "struct",
"size": 16
}
},
"symbols": {
},
"enums": {
},
"base_types": {
"unsigned long": {
"endian": "little",
"kind": "int",
"signed": false,
"size": 4
}
}
}
volatility/framework/symbols/windows/poolheader-x64.json
+73
View File
@@ -0,0 +1,73 @@
{
"metadata": {
"producer": {
"version": "0.1.5",
"name": "mhl-by-hand",
"datetime": "2018-10-03T16:53:00.478000"
},
"format": "4.0.0"
},
"user_types": {
"_POOL_HEADER": {
"fields": {
"BlockSize": {
"offset": 2,
"type": {
"bit_length": 8,
"bit_position": 0,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"PoolIndex": {
"offset": 0,
"type": {
"bit_length": 8,
"bit_position": 8,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"PoolTag": {
"offset": 4,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"PoolType": {
"offset": 2,
"type": {
"bit_length": 8,
"bit_position": 8,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
}
},
"kind": "struct",
"size": 16
}
},
"symbols": {
},
"enums": {
},
"base_types": {
"unsigned long": {
"endian": "little",
"kind": "int",
"signed": false,
"size": 4
}
}
}
volatility/framework/symbols/windows/poolheader-x86.json
+73
View File
@@ -0,0 +1,73 @@
{
"metadata": {
"producer": {
"version": "0.1.5",
"name": "mhl-by-hand",
"datetime": "2018-10-03T16:53:00.478000"
},
"format": "4.0.0"
},
"user_types": {
"_POOL_HEADER": {
"fields": {
"BlockSize": {
"offset": 2,
"type": {
"bit_length": 9,
"bit_position": 0,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"PoolIndex": {
"offset": 0,
"type": {
"bit_length": 7,
"bit_position": 9,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"PoolTag": {
"offset": 4,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"PoolType": {
"offset": 2,
"type": {
"bit_length": 7,
"bit_position": 9,
"kind": "bitfield",
"type": {
"kind": "base",
"name": "unsigned short"
}
}
}
},
"kind": "struct",
"size": 16
}
},
"symbols": {
},
"enums": {
},
"base_types": {
"unsigned long": {
"endian": "little",
"kind": "int",
"signed": false,
"size": 4
}
}
}