WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up offset for PAE.

Browse Source
This commit is contained in:
Mike Auty
2016-12-04 10:24:33 +00:00
parent d8b72cfc14
commit 05ae4aa64a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/pdbscan.py
+1 -1
View File
@@ -177,7 +177,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
if physical_layer_name:
if context.memory[virtual_layer_name].bits_per_register == 32:
# The kernel starts exactly halfway through the address space, so shift the maximum_address down by 1
kvo = kernel['mz_offset'] + ((context.memory[virtual_layer_name].maximum_address + 1) >> 1)
kvo = kernel['mz_offset'] + (1 << (context.memory[virtual_layer_name].bits_per_register - 1))
elif context.memory[virtual_layer_name].bits_per_register == 64:
# The kernel starts in a chunk towards the end of the space
kvo = kernel['mz_offset'] + (