WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

malfind is reading chunks, not technically pages, so change PAGE_SIZE to CHUNK_SIZE

Browse Source
This commit is contained in:
Michael Ligh
2018-05-13 18:49:11 -05:00
parent deb81aa1c8
commit 21b2eb7ecc
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/malfind.py
+4 -4
View File
@@ -27,17 +27,17 @@ class Malfind(interfaces_plugins.PluginInterface):
:param vad: the MMVAD structure to test
"""
PAGE_SIZE = 0x1000
all_zero_page = "\x00" * PAGE_SIZE
CHUNK_SIZE = 0x1000
all_zero_page = "\x00" * CHUNK_SIZE
offset = 0
vad_length = vad.get_end() - vad.get_start()
while offset < vad_length:
next_addr = vad.get_start() + offset
if proc_layer.is_valid(next_addr) and proc_layer.read(next_addr, PAGE_SIZE) != all_zero_page:
if proc_layer.is_valid(next_addr) and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page:
return False
offset += PAGE_SIZE
offset += CHUNK_SIZE
return True