WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Poolscanner: Infomasks can be 0

Browse Source
This commit is contained in:
Mike Auty
2020-10-18 01:07:36 +01:00
parent 82b3477613
commit c53655e40c
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/pool.py
+2 -4
View File
@@ -95,8 +95,6 @@ class POOL_HEADER(objects.StructType):
byteorder = 'little', signed = True)
if not 0x1000000 > pointercount_value >= 0:
continue
if not infomask_value:
continue
padding_present = False
optional_headers_length = 0
@@ -169,8 +167,8 @@ class POOL_HEADER(objects.StructType):
headers = []
sizes = []
for header in [
'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO',
'HANDLE_REVOCATION_INFO', 'PADDING_INFO'
'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO',
'HANDLE_REVOCATION_INFO', 'PADDING_INFO'
]:
try:
type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header)