From 98db5e46d4499f05164e8d945c1ebd51b3e7126f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 19 Aug 2021 11:12:05 +0100 Subject: [PATCH] Windows: Remove hardcoded parameter in poolscanner --- volatility3/framework/plugins/windows/poolscanner.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index a6a6cae0c..09f384d89 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -294,7 +294,7 @@ class PoolScanner(plugins.PluginInterface): mem_object = header.get_object(type_name = constraint.type_name, use_top_down = is_windows_8_or_later, executive = constraint.object_type is not None, - native_layer_name = 'primary', + native_layer_name = layer_name, kernel_symbol_table = symbol_table) if mem_object is None: