add the modscan plugin

2026-09-13 13:17:38 +02:00 · 2019-03-04 11:02:53 -06:00
parent 901a38d40b
commit fb36db098e
2 changed files with 93 additions and 0 deletions
@@ -232,6 +232,12 @@ class PoolScanner(plugins.PluginInterface):
                object_type = "Driver",
                size = (248, None),
                page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
+            # kernel modules
+            PoolConstraint(
+                b'MmLd',
+                type_name = symbol_table + constants.BANG + "_LDR_DATA_TABLE_ENTRY",
+                size = (76, None),
+                page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
        ]

        if not tags_filter: