WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-25 23:52:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure we set the correct page_map_offset by masking it to the size of the physical register maximum.

Browse Source
This commit is contained in:
Mike Auty
2017-01-02 22:12:52 +00:00
parent 1af85d628f
commit 24aecb49b7
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+4
View File
@@ -31,6 +31,10 @@ class _EPROCESS(objects.Struct):
# Presumably for 64-bit systems, the DTB is defined as an array, rather than an unsigned long long
if isinstance(self.Pcb.DirectoryTableBase, objects.Array):
parent_config['page_map_offset'] = self.Pcb.DirectoryTableBase.cast("unsigned long long")
else:
parent_config['page_map_offset'] = self.Pcb.DirectoryTableBase
parent_config['page_map_offset'] = parent_config['page_map_offset'] & (
(1 << parent_layer.bits_per_register) - 1)
# Set the new configuration and construct the layer
config_path = interfaces.configuration.path_join(config_prefix, preferred_name)