diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 5353fc30b..f75c6c417 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -59,7 +59,7 @@ class POOL_HEADER(objects.StructType): layer_name = self.vol.layer_name, offset = self.vol.offset + pool_header_size, native_layer_name = native_layer_name) - return mem_object + yield mem_object # otherwise we have an executive object in the pool else: @@ -145,7 +145,7 @@ class POOL_HEADER(objects.StructType): native_layer_name = native_layer_name) if mem_object.is_valid(): - return mem_object + yield mem_object except (TypeError, exceptions.InvalidAddressException): pass @@ -166,10 +166,9 @@ class POOL_HEADER(objects.StructType): try: if mem_object.is_valid(): - return mem_object + yield mem_object except (TypeError, exceptions.InvalidAddressException): - return None - return None + pass @classmethod @functools.lru_cache() diff --git a/volatility3/framework/symbols/windows/poolheader-x86.json b/volatility3/framework/symbols/windows/poolheader-x86.json index d117a8b2c..72f2c6cc1 100644 --- a/volatility3/framework/symbols/windows/poolheader-x86.json +++ b/volatility3/framework/symbols/windows/poolheader-x86.json @@ -55,7 +55,7 @@ } }, "kind": "struct", - "size": 16 + "size": 8 } }, "symbols": { diff --git a/volatility3/plugins/windows/poolscanner.py b/volatility3/plugins/windows/poolscanner.py index 951edac66..4885c88d7 100644 --- a/volatility3/plugins/windows/poolscanner.py +++ b/volatility3/plugins/windows/poolscanner.py @@ -121,7 +121,7 @@ class PoolScanner(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'handles', plugin = handles.Handles, version = (1, 0, 0)), ]