WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

add mutantscan

Browse Source
This commit is contained in:
Analyst
2019-02-27 12:49:50 -06:00
parent 8c85d133f0
commit b1c3ecfa17
4 changed files with 100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/poolscanner.py
+14
View File
@@ -204,6 +204,20 @@ class PoolScanner(plugins.PluginInterface):
object_type = "File",
size = (150, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# mutants on windows before windows 8
PoolConstraint(
b'Mut\xe1',
type_name = symbol_table + constants.BANG + "_KMUTANT",
object_type = "Mutant",
size = (64, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# mutants on windows starting with windows 8
PoolConstraint(
b'Muta',
type_name = symbol_table + constants.BANG + "_KMUTANT",
object_type = "Mutant",
size = (64, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
]
if not tags_filter: