From 05ae4aa64aa0c5bfa32f59a13063515d4490df2e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 4 Dec 2016 10:24:33 +0000 Subject: [PATCH] Fix up offset for PAE. --- volatility/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 85ef073ff..a73809035 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -177,7 +177,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if physical_layer_name: if context.memory[virtual_layer_name].bits_per_register == 32: # The kernel starts exactly halfway through the address space, so shift the maximum_address down by 1 - kvo = kernel['mz_offset'] + ((context.memory[virtual_layer_name].maximum_address + 1) >> 1) + kvo = kernel['mz_offset'] + (1 << (context.memory[virtual_layer_name].bits_per_register - 1)) elif context.memory[virtual_layer_name].bits_per_register == 64: # The kernel starts in a chunk towards the end of the space kvo = kernel['mz_offset'] + (