Windows: Fixes bad structure member in callbacks

volatilityfoundation / volatility3

Volatility 3.0 development

http://volatilityfoundation.org/

Other

2.72k stars 463 forks source link

Windows: Fixes bad structure member in callbacks #1224

Closed dgmcdona closed 3 months ago

dgmcdona commented 4 months ago

This fixes a bug in the x64 callbacks symbols. The NotificationRoutine is currently an unsigned int instead of a void pointer. This prevents the correct mapping of the notification routine to the kernel module that contains it.

Also bumps the version number for the netstat plugin's modules requirement - it didn't get updated after #1173 was merged.

atcuno commented 4 months ago

@ikelos this was found in some large scale testing. Verified as fixed with the patch.