From 80fc44f0505ea6af7e77d491e4c46ec79b3e2cf3 Mon Sep 17 00:00:00 2001
From: Michael Ligh <mligh@volexity.com>
Date: Tue, 16 Jan 2018 19:20:01 -0600
Subject: [PATCH] Fixing the ssdt plugin on Windows 10.0.10586.x

---
 volatility/plugins/overlays/windows/win10.py | 8 ++++----
 volatility/plugins/ssdt.py                   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py
index 0af94d26..990e9ddd 100644
--- a/volatility/plugins/overlays/windows/win10.py
+++ b/volatility/plugins/overlays/windows/win10.py
@@ -648,7 +648,7 @@ class Win10ObjectHeader(obj.ProfileModification):
                 profile.object_classes.update({
                     "_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42})
             
-        elif build >= 10240:
+        elif build >= 10586:
             header = _OBJECT_HEADER_10_1AC738FB
         else:
             header = _OBJECT_HEADER_10
@@ -689,7 +689,7 @@ class Win10PoolHeader(obj.ProfileModification):
     conditions = {'os': lambda x: x == 'windows',
                   'major': lambda x: x == 6,
                   'minor': lambda x: x == 4,
-                  'build': lambda x: x == 10240}
+                  'build': lambda x: x == 10586}
 
     def modification(self, profile):
 
@@ -738,7 +738,7 @@ class Win10x64_10586(obj.Profile):
     _md_os = 'windows'
     _md_major = 6
     _md_minor = 4
-    _md_build = 10240
+    _md_build = 10586
     _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes'
     _md_product = ["NtProductWinNt"]
 
@@ -768,7 +768,7 @@ class Win10x86_10586(obj.Profile):
     _md_os = 'windows'
     _md_major = 6
     _md_minor = 4
-    _md_build = 10240
+    _md_build = 10586
     _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_44B89EEA_vtypes'
     _md_product = ["NtProductWinNt"]
 
diff --git a/volatility/plugins/ssdt.py b/volatility/plugins/ssdt.py
index 86d99a63..4fa24be3 100644
--- a/volatility/plugins/ssdt.py
+++ b/volatility/plugins/ssdt.py
@@ -86,7 +86,7 @@ def find_tables(nt_base, start_addr, vm):
             if op.mnemonic == 'CMP' and op.operands[0].dispSize == 32 and op.operands[0].value == 0:
                 if op.size == 9:
                     service_tables.append(nt_base + op.operands[0].disp)
-                elif op.size == 7:
+                elif op.size in [7, 8]:
                     service_tables.append(op.address + op.size + op.operands[0].disp)
             elif op.mnemonic == 'LEA' and op.size == 7 and op.operands[1].dispSize == 32 and op.operands[1].disp > 0:
                 service_tables.append(nt_base + op.operands[1].disp)