WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-10-01 05:54:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

adds dynamic length of pool header alignments

Browse Source
This commit is contained in:
Jan
2020-07-17 18:07:23 +01:00
committed by ikelos
parent af1b8c03e7
commit e5d51eb9b7
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/poolscanner.py
+6 -1
View File
@@ -361,7 +361,12 @@ class PoolScanner(plugins.PluginInterface):
if not is_windows_10:
scan_layer = context.layers[scan_layer].config['memory_layer']
for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = 8):
if symbols.symbol_table_is_64bit(context, symbol_table):
alignment = 0x10
else:
alignment = 8
for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = alignment):
mem_object = header.get_object(type_name = constraint.type_name,
use_top_down = is_windows_8_or_later,