diff --git a/volatility/framework/symbols/windows/poolheader-x64-win7.json b/volatility/framework/symbols/windows/poolheader-x64-win7.json new file mode 100644 index 000000000..bada5168a --- /dev/null +++ b/volatility/framework/symbols/windows/poolheader-x64-win7.json @@ -0,0 +1,73 @@ +{ + "metadata": { + "producer": { + "version": "0.1.5", + "name": "mhl-by-hand", + "datetime": "2018-10-03T16:53:00.478000" + }, + "format": "4.0.0" + }, + "user_types": { + "_POOL_HEADER": { + "fields": { + "BlockSize": { + "offset": 0, + "type": { + "bit_length": 8, + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "PoolIndex": { + "offset": 0, + "type": { + "bit_length": 8, + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "PoolTag": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PoolType": { + "offset": 0, + "type": { + "bit_length": 8, + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + } + }, + "kind": "struct", + "size": 16 + } + }, + "symbols": { + }, + "enums": { + }, + "base_types": { + "unsigned long": { + "endian": "little", + "kind": "int", + "signed": false, + "size": 4 + } + } +} \ No newline at end of file diff --git a/volatility/framework/symbols/windows/poolheader-x64.json b/volatility/framework/symbols/windows/poolheader-x64.json new file mode 100644 index 000000000..30ac3636b --- /dev/null +++ b/volatility/framework/symbols/windows/poolheader-x64.json @@ -0,0 +1,73 @@ +{ + "metadata": { + "producer": { + "version": "0.1.5", + "name": "mhl-by-hand", + "datetime": "2018-10-03T16:53:00.478000" + }, + "format": "4.0.0" + }, + "user_types": { + "_POOL_HEADER": { + "fields": { + "BlockSize": { + "offset": 2, + "type": { + "bit_length": 8, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "PoolIndex": { + "offset": 0, + "type": { + "bit_length": 8, + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "PoolTag": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PoolType": { + "offset": 2, + "type": { + "bit_length": 8, + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + } + }, + "kind": "struct", + "size": 16 + } + }, + "symbols": { + }, + "enums": { + }, + "base_types": { + "unsigned long": { + "endian": "little", + "kind": "int", + "signed": false, + "size": 4 + } + } +} \ No newline at end of file diff --git a/volatility/framework/symbols/windows/poolheader-x86.json b/volatility/framework/symbols/windows/poolheader-x86.json new file mode 100644 index 000000000..f64a9c27d --- /dev/null +++ b/volatility/framework/symbols/windows/poolheader-x86.json @@ -0,0 +1,73 @@ +{ + "metadata": { + "producer": { + "version": "0.1.5", + "name": "mhl-by-hand", + "datetime": "2018-10-03T16:53:00.478000" + }, + "format": "4.0.0" + }, + "user_types": { + "_POOL_HEADER": { + "fields": { + "BlockSize": { + "offset": 2, + "type": { + "bit_length": 9, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "PoolIndex": { + "offset": 0, + "type": { + "bit_length": 7, + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "PoolTag": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PoolType": { + "offset": 2, + "type": { + "bit_length": 7, + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned short" + } + } + } + }, + "kind": "struct", + "size": 16 + } + }, + "symbols": { + }, + "enums": { + }, + "base_types": { + "unsigned long": { + "endian": "little", + "kind": "int", + "signed": false, + "size": 4 + } + } +} \ No newline at end of file