diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py index 984165d4b..26a166251 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility/framework/constants/__init__.py @@ -39,7 +39,7 @@ BANG = "!" # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 1 # Number of releases of the library with a breaking change -VERSION_MINOR = 1 # Number of changes that only add to the interface +VERSION_MINOR = 2 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "-beta.1" diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index c7b8de0a5..062a8d197 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -182,6 +182,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) + _required_framework_version = (1, 2, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility/framework/symbols/windows/extensions/pool.py index c169b2d8f..6990506de 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility/framework/symbols/windows/extensions/pool.py @@ -17,6 +17,7 @@ class POOL_HEADER(objects.StructType): type_name: str, use_top_down: bool, executive: bool = False, + kernel_symbol_table: Optional[str] = None, native_layer_name: Optional[str] = None) -> Optional[interfaces.objects.ObjectInterface]: """Carve an object or data structure from a kernel pool allocation @@ -24,6 +25,7 @@ class POOL_HEADER(objects.StructType): type_name: the data structure type name native_layer_name: the name of the layer where the data originally lived object_type: the object type (executive kernel objects only) + kernel_symbol_table: in case objects of a different symbol table are scanned for Returns: An object as found from a POOL_HEADER @@ -33,7 +35,16 @@ class POOL_HEADER(objects.StructType): if constants.BANG in type_name: symbol_table_name, type_name = type_name.split(constants.BANG)[0:2] - object_header_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_OBJECT_HEADER") + # when checking for symbols from a table other than nt_symbols grab _OBJECT_HEADER from the kernel + # because symbol_table_name will be different from kernel_symbol_table. + if kernel_symbol_table: + object_header_type = self._context.symbol_space.get_type(kernel_symbol_table + constants.BANG + + "_OBJECT_HEADER") + else: + # otherwise symbol_table_name *is* the kernel symbol table, so just use that. + object_header_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + + "_OBJECT_HEADER") + pool_header_size = self.vol.size # if there is no object type, then just instantiate a structure