Files
volatility3/volatility/framework/symbols/windows/bigpools-x64.json
T

72 lines
1.5 KiB
JSON

{
"metadata": {
"producer": {
"version": "0.0.1",
"name": "dlassalle-by-hand",
"datetime": "2020-04-30T14:30:00.000000"
},
"format": "6.2.0"
},
"user_types": {
"_POOL_TRACKER_BIG_PAGES": {
"fields": {
"Va": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long long"
}
},
"Key": {
"offset": 8,
"type": {
"kind": "base",
"name": "unsigned long"
}
}
},
"kind": "struct",
"size": 12
}
},
"symbols": {
},
"enums": {
"_POOL_TYPE": {
"base": "unsigned long",
"constants": {
"NonPagedPool": 0,
"PagedPool": 1,
"NonPagedPoolMustSucceed": 2,
"DontUseThisType": 3,
"NonPagedPoolCacheAligned": 4,
"PagedPoolAligned": 5,
"NonPagedPoolCacheAlignedMustS": 6,
"MaxPoolType": 7,
"NonPagedPoolMustSucceedSession": 34,
"DontUseThisTypeSession": 35,
"NonPagedPoolSession": 32,
"PagedPoolSession": 33,
"NonPagedPoolCacheAlignedMustSSession": 38,
"PagedPoolCacheAlignedSession": 37,
"NonPagedPoolCacheAlignedSession": 36
},
"size": 4
}
},
"base_types": {
"unsigned long long": {
"endian": "little",
"kind": "int",
"signed": false,
"size": 8
},
"unsigned long": {
"endian": "little",
"kind": "int",
"signed": false,
"size": 4
}
}
}