psscan relies on WorkingSetLock which isn't in vtypes for windows 7 x86 images about volatility HOT 9 CLOSED

Forgot to add... The host machine is 64 bit windows 7 running python 2.7

Yep, this can be recreated with any Windows 7 image and psscan plugin.  It 
appears this plugin looks for the WorkingSetLock attribute of an _EPROCESS, 
which isn't defined for Vista/7.

Ok, so Vista and 7 don't have a WorkingSetLock, and there's something else at 
the same offset, so we're going to have to change how psscan finds/validates 
potential _EPROCESS objects.  That's probably something for mooyix or 
labarumXP, so I'm assigning it to them.

Sorry for the bugspam, but better to get this right now than later once it's 
more in use.

It looks as though the DispatchHeader scanner (psscan) is slower than the Pool 
scanner (psscan2) and only turns up results that psscan2 doesn't in very 
specific situations (such as the Idle "process" and malware that's capable of 
messing with anything it pleases, in which case it could avoid psscan as well).

We're therefore going to move psscan into the contrib directory, and rename all 
the remaining "scan2" plugins into "scan" plugins.  The descriptions may need 
updating to make them more accurate.  I'll make sure psscan details that it 
scans for pool headers, but more than that I'll need other people to 
comment/patch/shout at me on IRC...  5:)

This issue was closed by revision r1003.