From f0bc947bba669f124992afe47d520e25c628eea7 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Sat, 22 Aug 2020 16:19:14 -0500 Subject: [PATCH] add a comment about the pool header class type matching the kernel --- volatility/framework/plugins/windows/poolscanner.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index e2ee83ab5..8f18d48a0 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -448,6 +448,7 @@ class PoolScanner(plugins.PluginInterface): else: pool_header_json_filename = "poolheader-x86" + # set the class_type to match the normal WindowsKernelIntermedSymbols is_vista_or_later = cls.is_vista_or_later(context, symbol_table) if is_vista_or_later: class_type = extensions.pool.POOL_HEADER_VISTA