From 2655fd1666a38e455b809e9c795cf62e60582fea Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 19 Dec 2018 11:12:58 -0600 Subject: [PATCH] prevent double shifting of ASLR slides --- volatility/framework/automagic/linux.py | 2 +- volatility/framework/automagic/mac.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index c66bbc84a..1b08e7d91 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -258,7 +258,7 @@ class LinuxUtilities(object): aslr_layer = sym_layer.config['memory_layer'] _, aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer) - symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) + symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) @classmethod def find_aslr(cls, diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index a5979051b..f61bf55b3 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -123,7 +123,7 @@ class MacUtilities(object): aslr_layer = sym_layer.config['memory_layer'] aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer) - symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) + symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) @classmethod def _scan_generator(cls, context, layer_name, progress_callback):