diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index dd2912e5e..436a88b56 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -23,8 +23,7 @@ class _POOL_HEADER(objects.Struct): type_map: dict, native_layer_name: typing.Optional[str] = None, object_type: typing.Optional[str] = None, - cookie: typing.Optional[int] = None, - symbol_table_name: typing.Optional[str] = None) \ + cookie: typing.Optional[int] = None) \ -> typing.Optional[interfaces.objects.ObjectInterface]: """Carve an object or data structure from a kernel pool allocation. @@ -34,7 +33,10 @@ class _POOL_HEADER(objects.Struct): :return: """ - symbol_table_name = symbol_table_name or self.vol.type_name.split(constants.BANG)[0] + symbol_table_name = self.vol.type_name.split(constants.BANG)[0] + if constants.BANG in type_name: + symbol_table_name, type_name = type_name.split(constants.BANG)[0:2] + pool_header_size = self.vol.size # if there is no object type, then just instantiate a structure diff --git a/volatility/plugins/windows/poolscanner.py b/volatility/plugins/windows/poolscanner.py index b28ce8fe0..7168dd2bf 100644 --- a/volatility/plugins/windows/poolscanner.py +++ b/volatility/plugins/windows/poolscanner.py @@ -63,30 +63,30 @@ class PoolScanner(plugins.PluginInterface): constraints = [ # atom tables PoolConstraint(b'AtmT', - type_name = "_RTL_ATOM_TABLE", + type_name = self.config["nt_symbols"] + constants.BANG + "_RTL_ATOM_TABLE", size = (200, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # processes on windows before windows 8 PoolConstraint(b'Pro\xe3', - type_name = "_EPROCESS", + type_name = self.config["nt_symbols"] + constants.BANG + "_EPROCESS", object_type = "Process", size = (600, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # processes on windows starting with windows 8 PoolConstraint(b'Proc', - type_name = "_EPROCESS", + type_name = self.config["nt_symbols"] + constants.BANG + "_EPROCESS", object_type = "Process", size = (600, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # files on windows before windows 8 PoolConstraint(b'Fil\xe5', - type_name = "_FILE_OBJECT", + type_name = self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT", object_type = "File", size = (150, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # files on windows starting with windows 8 PoolConstraint(b'File', - type_name = "_FILE_OBJECT", + type_name = self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT", object_type = "File", size = (150, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), @@ -122,8 +122,7 @@ class PoolScanner(plugins.PluginInterface): type_map = type_map, object_type = constraint.object_type, native_layer_name = 'primary', - cookie = cookie, - symbol_table_name = self.config['nt_symbols']) + cookie = cookie) if mem_object is None: vollog.log(constants.LOGLEVEL_VVV, "Cannot create an instance of {}".format(constraint.type_name))