WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 21:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Fix callbacks is_vista_or_later

Browse Source
This commit is contained in:
Mike Auty
2020-09-15 01:28:48 +01:00
parent 5e53440b43
commit c82ad2fbd0
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/callbacks.py
+2 -1
View File
@@ -9,6 +9,7 @@ from volatility.framework import constants, exceptions, renderers, interfaces, s
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import intermed
from volatility.framework.symbols.windows import versions
from volatility.plugins.windows import ssdt
from volatility.plugins.windows import svcscan
@@ -77,7 +78,7 @@ class Callbacks(interfaces.plugins.PluginInterface):
kvo = context.layers[layer_name].config['kernel_virtual_offset']
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
is_vista_or_later = svcscan.SvcScan.is_vista_or_later(context = context, symbol_table = symbol_table)
is_vista_or_later = versions.is_vista_or_later(context = context, symbol_table = symbol_table)
full_type_name = callback_table_name + constants.BANG + "_GENERIC_CALLBACK"
symbol_names = [("PspLoadImageNotifyRoutine", False), ("PspCreateThreadNotifyRoutine", True),