WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix a bug in psscan on xp images

Browse Source 
we need to get the kvo using the native_layer_name rather than the layer_name
This commit is contained in:
Michael Ligh
2019-03-19 11:14:10 -05:00
parent f1bbba1048
commit 2138152b10
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+2 -3
View File
@@ -690,12 +690,11 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
if self.Session == 0:
return renderers.NotApplicableValue()
layer_name = self.vol.layer_name
symbol_table_name = self.get_symbol_table().name
kvo = self._context.memory[layer_name].config['kernel_virtual_offset']
kvo = self._context.memory[self.vol.native_layer_name].config['kernel_virtual_offset']
ntkrnlmp = self._context.module(
symbol_table_name,
layer_name = layer_name,
layer_name = self.vol.layer_name,
offset = kvo,
native_layer_name = self.vol.native_layer_name)
session = ntkrnlmp.object(type_name = "_MM_SESSION_SPACE", offset = self.Session)