Merge pull request #531 from volatilityfoundation/poolscan_fix_get_object_generator

[API] fix mutantscan (and possibly others)

volatility3/framework/symbols/windows/extensions/pool.py

@@ -59,7 +59,7 @@ class POOL_HEADER(objects.StructType):
                                               layer_name = self.vol.layer_name,
                                               offset = self.vol.offset + pool_header_size,
                                               native_layer_name = native_layer_name)
-            return mem_object
+            yield mem_object
 
         # otherwise we have an executive object in the pool
         else:
@@ -145,7 +145,7 @@ class POOL_HEADER(objects.StructType):
                                                           native_layer_name = native_layer_name)
 
                         if mem_object.is_valid():
-                            return mem_object
+                            yield mem_object
 
                     except (TypeError, exceptions.InvalidAddressException):
                         pass
@@ -166,10 +166,9 @@ class POOL_HEADER(objects.StructType):
 
                 try:
                     if mem_object.is_valid():
-                        return mem_object
+                        yield mem_object
                 except (TypeError, exceptions.InvalidAddressException):
-                    return None
-        return None
+                    pass
 
     @classmethod
     @functools.lru_cache()

volatility3/framework/symbols/windows/poolheader-x86.json

@@ -55,7 +55,7 @@
         }
       },
       "kind": "struct",
-      "size": 16
+      "size": 8
     }
   },
   "symbols": {

volatility3/plugins/windows/poolscanner.py

@@ -121,7 +121,7 @@ class PoolScanner(plugins.PluginInterface):
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [
             requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel',
-                                           architectures = ["Intel32", "Intel64"]),
+                                                     architectures = ["Intel32", "Intel64"]),
             requirements.PluginRequirement(name = 'handles', plugin = handles.Handles, version = (1, 0, 0)),
         ]