bumps version number due to api change, clarifies code

volatility/framework/constants/__init__.py

@@ -39,7 +39,7 @@ BANG = "!"
 
 # We use the SemVer 2.0.0 versioning scheme
 VERSION_MAJOR = 1  # Number of releases of the library with a breaking change
-VERSION_MINOR = 1  # Number of changes that only add to the interface
+VERSION_MINOR = 2  # Number of changes that only add to the interface
 VERSION_PATCH = 0  # Number of changes that do not change the interface
 VERSION_SUFFIX = "-beta.1"
 

volatility/framework/plugins/windows/poolscanner.py

@@ -182,6 +182,7 @@ class PoolScanner(plugins.PluginInterface):
     """A generic pool scanner plugin."""
 
     _version = (1, 0, 0)
+    _required_framework_version = (1, 2, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/symbols/windows/extensions/pool.py

@@ -17,6 +17,7 @@ class POOL_HEADER(objects.StructType):
                    type_name: str,
                    use_top_down: bool,
                    executive: bool = False,
+                   kernel_symbol_table: Optional[str] = None,
                    native_layer_name: Optional[str] = None) -> Optional[interfaces.objects.ObjectInterface]:
         """Carve an object or data structure from a kernel pool allocation
 
@@ -24,6 +25,7 @@ class POOL_HEADER(objects.StructType):
             type_name: the data structure type name
             native_layer_name: the name of the layer where the data originally lived
             object_type: the object type (executive kernel objects only)
+            kernel_symbol_table: in case objects of a different symbol table are scanned for
 
         Returns:
             An object as found from a POOL_HEADER
@@ -33,7 +35,16 @@ class POOL_HEADER(objects.StructType):
         if constants.BANG in type_name:
             symbol_table_name, type_name = type_name.split(constants.BANG)[0:2]
 
-        object_header_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_OBJECT_HEADER")
+        # when checking for symbols from a table other than nt_symbols grab _OBJECT_HEADER from the kernel
+        # because symbol_table_name will be different from kernel_symbol_table.
+        if kernel_symbol_table:
+            object_header_type = self._context.symbol_space.get_type(kernel_symbol_table + constants.BANG +
+                                                                 "_OBJECT_HEADER")
+        else:
+            # otherwise symbol_table_name *is* the kernel symbol table, so just use that.
+            object_header_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG +
+                                                                 "_OBJECT_HEADER")
+
         pool_header_size = self.vol.size
 
         # if there is no object type, then just instantiate a structure