From 2918c13046b91ecdae1fba6599d291fc7ba95ce7 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 9 Aug 2022 15:24:40 +0900 Subject: [PATCH] Fix: offset for job entry --- volatility3/framework/plugins/windows/joblinks.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index e88b7a3d3..39089a741 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -56,6 +56,12 @@ class JobLinks(interfaces.plugins.PluginInterface): )) for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"): + + if not self.config['physical']: + offset = entry.vol.offset + else: + (_, _, offset, _, _) = list(memory.mapping(offset = entry.vol.offset, length = 0))[0] + yield (1, ( format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId, entry.InheritedFromUniqueProcessId, entry.get_session_id(), 0, entry.get_is_wow64(),