From 24aecb49b72c19b8bea58f43fd7b08852a350af5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 2 Jan 2017 22:12:52 +0000 Subject: [PATCH] Ensure we set the correct page_map_offset by masking it to the size of the physical register maximum. --- volatility/framework/symbols/windows/extensions/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index f440c1649..853c1d261 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -31,6 +31,10 @@ class _EPROCESS(objects.Struct): # Presumably for 64-bit systems, the DTB is defined as an array, rather than an unsigned long long if isinstance(self.Pcb.DirectoryTableBase, objects.Array): parent_config['page_map_offset'] = self.Pcb.DirectoryTableBase.cast("unsigned long long") + else: + parent_config['page_map_offset'] = self.Pcb.DirectoryTableBase + parent_config['page_map_offset'] = parent_config['page_map_offset'] & ( + (1 << parent_layer.bits_per_register) - 1) # Set the new configuration and construct the layer config_path = interfaces.configuration.path_join(config_prefix, preferred_name)