WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299

Browse Source
This commit is contained in:
Michael Ligh
2019-12-04 21:19:19 +00:00
committed by ikelos
parent 1eea645da0
commit d0f9cf9a2f
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/svcscan.py
+2 -1
View File
@@ -35,7 +35,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 16299),
fallback_checks = [("ObHeaderCookie", None, True),
("_HANDLE_TABLE", "HandleCount", False),
("ObHeaderCookie", None, True)])
("ObHeaderCookie", None, True),
("_EPROCESS", "ControlFlowGuardEnabled", True)])
is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299),
fallback_checks = [("ObHeaderCookie", None, True),