From d7d176d04010ec2f1caebdcd473c644d8ed87792 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 11:36:56 -0600 Subject: [PATCH] add Is64Bit and IsPAE properties to the windows.info plugin --- volatility/framework/plugins/windows/info.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 90ede538a..8a40f305a 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -5,7 +5,7 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers +from volatility.framework import constants, interfaces, layers, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import TreeGrid @@ -158,6 +158,8 @@ class Info(plugins.PluginInterface): yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) + yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) + yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__)))