From 2138152b108a87958811b68cab83b7205f09cd53 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Tue, 19 Mar 2019 11:14:10 -0500 Subject: [PATCH] fix a bug in psscan on xp images we need to get the kvo using the native_layer_name rather than the layer_name --- volatility/framework/symbols/windows/extensions/__init__.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 539a85585..1ebcf9dc2 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -690,12 +690,11 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): if self.Session == 0: return renderers.NotApplicableValue() - layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table().name - kvo = self._context.memory[layer_name].config['kernel_virtual_offset'] + kvo = self._context.memory[self.vol.native_layer_name].config['kernel_virtual_offset'] ntkrnlmp = self._context.module( symbol_table_name, - layer_name = layer_name, + layer_name = self.vol.layer_name, offset = kvo, native_layer_name = self.vol.native_layer_name) session = ntkrnlmp.object(type_name = "_MM_SESSION_SPACE", offset = self.Session)