diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 4dd712ab7..1770a04fd 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -140,7 +140,8 @@ class String(PrimitiveObject, str): layer_name = object_info.layer_name, offset = object_info.offset), **params) - # We don't truncate on "\x00" because the string decoder does that for us + if value.find('\x00') >= 0: + value = value[:value.find('\x00')] return value