From c53655e40c2fda3d1b6b06eb09e76c3f6bdfed26 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 18 Oct 2020 01:07:36 +0100 Subject: [PATCH] Poolscanner: Infomasks can be 0 --- volatility/framework/symbols/windows/extensions/pool.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility/framework/symbols/windows/extensions/pool.py index e36e8348e..ecb3d74f0 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility/framework/symbols/windows/extensions/pool.py @@ -95,8 +95,6 @@ class POOL_HEADER(objects.StructType): byteorder = 'little', signed = True) if not 0x1000000 > pointercount_value >= 0: continue - if not infomask_value: - continue padding_present = False optional_headers_length = 0 @@ -169,8 +167,8 @@ class POOL_HEADER(objects.StructType): headers = [] sizes = [] for header in [ - 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', - 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' + 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', + 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' ]: try: type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header)