From ba7ec0059960fd6470254e8b3cd4ae15e89ea174 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Mon, 29 Jul 2024 17:55:56 -0500
Subject: [PATCH] Windows: Fixes bad structure member in callbacks

This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
---
 volatility3/framework/symbols/windows/callbacks-x64.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/windows/callbacks-x64.json b/volatility3/framework/symbols/windows/callbacks-x64.json
index 3f891b94f..705f2361d 100644
--- a/volatility3/framework/symbols/windows/callbacks-x64.json
+++ b/volatility3/framework/symbols/windows/callbacks-x64.json
@@ -105,8 +105,11 @@
                 },
                 "NotificationRoutine": {
                     "type": {
-                        "kind": "base",
-                        "name": "unsigned int"
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
                     },
                     "offset": 24
                 }