From b0559656fc0412d0e70b64a70b53f82ed76b5c38 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 11 Sep 2019 01:22:40 +0100 Subject: [PATCH] Update the header offsets for the InfoMask. --- volatility/framework/symbols/windows/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index c80db2ef5..5b02bdb20 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -140,8 +140,8 @@ class _POOL_HEADER(objects.StructType): symbol_table_name: str) -> List[int]: sizes = [] for header in [ - 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', - 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' + 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'PADDING_INFO', + 'EXTENDED_INFO', 'HANDLE_REVOCATION_INFO' ]: try: type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header)