From 9d6055d2ba14271fa3af1b107f2ff5b1d95c0774 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 12 Sep 2018 09:48:23 -0500 Subject: [PATCH] add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks --- volatility/plugins/windows/poolscanner.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/windows/poolscanner.py b/volatility/plugins/windows/poolscanner.py index 98ac24d91..1b1db43d8 100644 --- a/volatility/plugins/windows/poolscanner.py +++ b/volatility/plugins/windows/poolscanner.py @@ -72,9 +72,20 @@ class PoolScanner(plugins.PluginInterface): size = (600, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), ] - base_layer = self.context.memory[self.config['primary']].config['memory_layer'] + + # FIXME: replace this lambda with a real function + is_windows_10 = lambda : False + + # FIXME: scanning the primary layer seems very slow (10min on 512mb grrcon) + # start off with the primary virtual layer + scan_layer = self.config['primary'] + + # switch to a non-virtual layer if necessary + if not is_windows_10(): + scan_layer = self.context.memory[scan_layer].config['memory_layer'] + for constraint, header in self.pool_scan(self._context, - base_layer, + scan_layer, self.config['nt_symbols'], constraints, alignment = 8):