diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 85ef073ff..a73809035 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -177,7 +177,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if physical_layer_name: if context.memory[virtual_layer_name].bits_per_register == 32: # The kernel starts exactly halfway through the address space, so shift the maximum_address down by 1 - kvo = kernel['mz_offset'] + ((context.memory[virtual_layer_name].maximum_address + 1) >> 1) + kvo = kernel['mz_offset'] + (1 << (context.memory[virtual_layer_name].bits_per_register - 1)) elif context.memory[virtual_layer_name].bits_per_register == 64: # The kernel starts in a chunk towards the end of the space kvo = kernel['mz_offset'] + (