Windows: Updates netscan with new symbol file

volatilityfoundation / volatility3

Volatility 3.0 development

http://volatilityfoundation.org/

Other

2.72k stars 461 forks source link

Windows: Updates netscan with new symbol file #1227

Closed dgmcdona closed 3 months ago

dgmcdona commented 3 months ago

netscan was missing coverage for Windows 10 Build 20348, causing owners and create times for _TCP_ENDPOINTS to be missing. This adds a symbol file and the necessary version check in the netscan plugin. Testing confirms that this returns the correct creation time and owner process.