Fix: offset for job entry

2026-09-08 02:37:39 +02:00 · 2022-08-09 15:24:40 +09:00
parent 3556b2374a
commit 2918c13046
1 changed files with 6 additions and 0 deletions
@@ -56,6 +56,12 @@ class JobLinks(interfaces.plugins.PluginInterface):
                ))

                for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"):
+
+                    if not self.config['physical']:
+                        offset = entry.vol.offset
+                    else:
+                        (_, _, offset, _, _) = list(memory.mapping(offset = entry.vol.offset, length = 0))[0]
+
                    yield (1, (
                        format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId,
                        entry.InheritedFromUniqueProcessId, entry.get_session_id(), 0, entry.get_is_wow64(),