Windows: fix missing TCP connections

This fixes some missing TCP connections in Windows 10 20348 by adding
a scan constraint for `TTcb` pool tags.
This commit is contained in:
David McDonald
2024-09-30 13:03:02 -05:00
parent 5a6958befa
commit d9dc28d0b5
@@ -76,7 +76,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
# ~ vollog.debug("Using pool size constraints: TcpL {}, TcpE {}, UdpA {}".format(tcpl_size, tcpe_size, udpa_size))
return [
constraints = [
# TCP listener
poolscanner.PoolConstraint(
b"TcpL",
@@ -100,6 +100,19 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
),
]
if symbol_table.startswith("netscan-win10-20348"):
vollog.debug("Adding additional pool constraint for `TTcb` tags")
constraints.append(
poolscanner.PoolConstraint(
b"TTcb",
type_name=symbol_table + constants.BANG + "_TCP_ENDPOINT",
size=(tcpe_size, None),
page_type=poolscanner.PoolType.NONPAGED | poolscanner.PoolType.FREE,
)
)
return constraints
@classmethod
def determine_tcpip_version(
cls,