From d0f9cf9a2fc0912f3e4298f52ce315b19664b2ac Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 4 Dec 2019 13:23:18 -0600 Subject: [PATCH] refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299 --- volatility/framework/plugins/windows/svcscan.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index 906b2ba1e..18fea9f0c 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -35,7 +35,8 @@ class SvcScan(interfaces.plugins.PluginInterface): is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 16299), fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), - ("ObHeaderCookie", None, True)]) + ("ObHeaderCookie", None, True), + ("_EPROCESS", "ControlFlowGuardEnabled", True)]) is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299), fallback_checks = [("ObHeaderCookie", None, True),