Windows: Group JSON symbols under directories

volatility3/framework/plugins/windows/bigpools.py

@@ -3,6 +3,7 @@
 #
 
 import logging
+import os
 from typing import List, Optional, Tuple, Iterator
 
 from volatility3.framework import interfaces, renderers, exceptions, symbols
@@ -83,7 +84,7 @@ class BigPools(interfaces.plugins.PluginInterface):
             new_table_name = intermed.IntermediateSymbolTable.create(
                 context = context,
                 config_path = configuration.path_join(context.symbol_space[symbol_table].config_path, "bigpools"),
-                sub_path = "windows",
+                sub_path = os.path.join("windows", "bigpools"),
                 filename = big_pools_json_filename,
                 table_mapping = {'nt_symbols': symbol_table},
                 class_types = {'_POOL_TRACKER_BIG_PAGES': extensions.pool.POOL_TRACKER_BIG_PAGES})

volatility3/framework/plugins/windows/netscan.py

@@ -4,6 +4,7 @@
 
 import datetime
 import logging
+import os
 from typing import Iterable, List, Optional, Tuple, Type
 
 from volatility3.framework import constants, exceptions, interfaces, renderers, symbols
@@ -244,7 +245,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
         return intermed.IntermediateSymbolTable.create(context,
                                                        config_path,
-                                                       "windows",
+                                                       os.path.join("windows", "netscan"),
                                                        symbol_filename,
                                                        class_types = class_types,
                                                        table_mapping = table_mapping)

volatility3/framework/plugins/windows/svcscan.py

@@ -87,7 +87,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
 
         return intermed.IntermediateSymbolTable.create(context,
                                                        config_path,
-                                                       "windows",
+                                                       os.path.join("windows", "services"),
                                                        symbol_filename,
                                                        class_types = services.class_types,
                                                        native_types = native_types)