From 21b2eb7eccdd7fdafdc7101610751f91e40b058f Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Sun, 13 May 2018 18:49:11 -0500 Subject: [PATCH] malfind is reading chunks, not technically pages, so change PAGE_SIZE to CHUNK_SIZE --- volatility/plugins/windows/malfind.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility/plugins/windows/malfind.py b/volatility/plugins/windows/malfind.py index e3e66d726..e087e4be8 100644 --- a/volatility/plugins/windows/malfind.py +++ b/volatility/plugins/windows/malfind.py @@ -27,17 +27,17 @@ class Malfind(interfaces_plugins.PluginInterface): :param vad: the MMVAD structure to test """ - PAGE_SIZE = 0x1000 - all_zero_page = "\x00" * PAGE_SIZE + CHUNK_SIZE = 0x1000 + all_zero_page = "\x00" * CHUNK_SIZE offset = 0 vad_length = vad.get_end() - vad.get_start() while offset < vad_length: next_addr = vad.get_start() + offset - if proc_layer.is_valid(next_addr) and proc_layer.read(next_addr, PAGE_SIZE) != all_zero_page: + if proc_layer.is_valid(next_addr) and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page: return False - offset += PAGE_SIZE + offset += CHUNK_SIZE return True