Adds correct EPROCESS offset in TCP_ENDPOINT struct for Win10 17134

tcpip_vtypes.py

class Win10Tcpip(obj.ProfileModification):
    before = ['Win8Tcpip']
    conditions = {'os': lambda x: x == 'windows',
                  'memory_model': lambda x: x == '32bit',
                  'major': lambda x : x == 6,
                  'minor': lambda x : x >= 4}
    def modification(self, profile):
        profile.merge_overlay({
        '_ADDRINFO' : [ None, {
            'Local' : [ 0x0, ['pointer', ['_LOCAL_ADDRESS']]],
            'Remote' : [ 0xC, ['pointer', ['_IN_ADDR']]],
        }],
        '_TCP_ENDPOINT': [ None, {
            'InetAF' : [ 0x8, ['pointer', ['_INETAF']]],
            'AddrInfo' : [ 0xC, ['pointer', ['_ADDRINFO']]],
            'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = TCP_STATE_ENUM)]],
            'LocalPort' : [ 0x3C, ['unsigned be short']],
            'RemotePort' : [ 0x3E, ['unsigned be short']],
            'Owner' : [ 0x1b0, ['pointer', ['_EPROCESS']]],
            }],
        })

        build = profile.metadata.get("build")

        if build == 14393:
            profile.merge_overlay({
                '_TCP_ENDPOINT': [ None, {
                'Owner' : [ 0x1b4, ['pointer', ['_EPROCESS']]],
                }],
            })
        elif build == 15063:
            profile.merge_overlay({
                '_TCP_ENDPOINT': [ None, {
                'Owner' : [ 0x1cc, ['pointer', ['_EPROCESS']]],
                }],
            })
        elif build == 17134:
            profile.merge_overlay({
                '_TCP_ENDPOINT': [ None, {
                'Owner' : [ 0x1d4, ['pointer', ['_EPROCESS']]],
                }],
            })