Skip to content

Commit 02fbb3c

Browse files
committed
Poolscanners: Fix symlink pool types
Fixes regression introduced in #1632 Symbolic links are allocated in the paged pools, not non-paged. This was causing us to miss symlinks across both pre and post win8 samples.
1 parent df03d22 commit 02fbb3c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

volatility3/framework/plugins/windows/poolscanner.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -343,15 +343,15 @@ def builtin_constraints(
343343
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
344344
object_type="SymbolicLink",
345345
size=(72, None),
346-
page_type=PoolType.NONPAGED | PoolType.FREE,
346+
page_type=PoolType.PAGED | PoolType.FREE,
347347
),
348348
# symlinks on windows starting with windows 8
349349
PoolConstraint(
350350
b"Symb",
351351
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
352352
object_type="SymbolicLink",
353353
size=(72, None),
354-
page_type=PoolType.NONPAGED | PoolType.FREE,
354+
page_type=PoolType.PAGED | PoolType.FREE,
355355
),
356356
# registry hives
357357
PoolConstraint(

0 commit comments

Comments
 (0)