From e80e9e09b68315e61d41beb7b7785d066755657f Mon Sep 17 00:00:00 2001
From: Michael Ligh <mligh@volexity.com>
Date: Fri, 3 Jan 2020 12:27:34 -0600
Subject: [PATCH] the hand-written 32-bit windows 10 service record types were
 missing the Tag member

---
 .../symbols/windows/services-win10-15063-x86.json   | 13 ++++++++++++-
 .../symbols/windows/services-win10-16299-x86.json   | 13 ++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/volatility/framework/symbols/windows/services-win10-15063-x86.json b/volatility/framework/symbols/windows/services-win10-15063-x86.json
index bac6641f9..36b3b33e3 100644
--- a/volatility/framework/symbols/windows/services-win10-15063-x86.json
+++ b/volatility/framework/symbols/windows/services-win10-15063-x86.json
@@ -196,7 +196,18 @@
                         }
                     },
                     "offset": 44
-                }, 
+                },
+                "Tag": {
+                    "type": {
+                        "count": 4,
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        },
+                        "kind": "array"
+                    },
+                    "offset": 0
+                },
                 "DriverName": {
                     "type": {
                         "kind": "pointer",
diff --git a/volatility/framework/symbols/windows/services-win10-16299-x86.json b/volatility/framework/symbols/windows/services-win10-16299-x86.json
index 421cb6134..8949765bb 100644
--- a/volatility/framework/symbols/windows/services-win10-16299-x86.json
+++ b/volatility/framework/symbols/windows/services-win10-16299-x86.json
@@ -196,7 +196,18 @@
                         }
                     }, 
                     "offset": 44
-                }, 
+                },
+                "Tag": {
+                    "type": {
+                        "count": 4,
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        },
+                        "kind": "array"
+                    },
+                    "offset": 0
+                },
                 "DriverName": {
                     "type": {
                         "kind": "pointer",