From eacc45dab6c335ed6807888e98f7ed9d85d616d4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 24 Oct 2018 19:54:17 +0100 Subject: [PATCH] Ensure POOL_HEADER finds the right object in the right symbol table. --- .../framework/symbols/windows/extensions/__init__.py | 12 +++++++----- volatility/plugins/windows/poolscanner.py | 3 ++- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 625c222f1..dd2912e5e 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -21,9 +21,11 @@ class _POOL_HEADER(objects.Struct): def get_object(self, type_name: str, type_map: dict, - native_layer_name: str = None, - object_type: str = None, - cookie: int = None) -> typing.Optional[interfaces.objects.ObjectInterface]: + native_layer_name: typing.Optional[str] = None, + object_type: typing.Optional[str] = None, + cookie: typing.Optional[int] = None, + symbol_table_name: typing.Optional[str] = None) \ + -> typing.Optional[interfaces.objects.ObjectInterface]: """Carve an object or data structure from a kernel pool allocation. :param type_name: the data structure type name @@ -32,8 +34,8 @@ class _POOL_HEADER(objects.Struct): :return: """ - symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - pool_header_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_POOL_HEADER").size + symbol_table_name = symbol_table_name or self.vol.type_name.split(constants.BANG)[0] + pool_header_size = self.vol.size # if there is no object type, then just instantiate a structure if object_type is None: diff --git a/volatility/plugins/windows/poolscanner.py b/volatility/plugins/windows/poolscanner.py index 8469ade8c..b28ce8fe0 100644 --- a/volatility/plugins/windows/poolscanner.py +++ b/volatility/plugins/windows/poolscanner.py @@ -122,7 +122,8 @@ class PoolScanner(plugins.PluginInterface): type_map = type_map, object_type = constraint.object_type, native_layer_name = 'primary', - cookie = cookie) + cookie = cookie, + symbol_table_name = self.config['nt_symbols']) if mem_object is None: vollog.log(constants.LOGLEVEL_VVV, "Cannot create an instance of {}".format(constraint.type_name))