diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index e2ee83ab5..8f18d48a0 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -448,6 +448,7 @@ class PoolScanner(plugins.PluginInterface): else: pool_header_json_filename = "poolheader-x86" + # set the class_type to match the normal WindowsKernelIntermedSymbols is_vista_or_later = cls.is_vista_or_later(context, symbol_table) if is_vista_or_later: class_type = extensions.pool.POOL_HEADER_VISTA