WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 04:09:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Ensure the kernel contains an actual kvo

Browse Source
This commit is contained in:
Mike Auty
2021-07-30 00:17:26 +01:00
parent e793956e02
commit 30eec0cb76
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/pdbscan.py
+5 -4
View File
@@ -124,10 +124,11 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
if valid_kernel:
# Set the virtual offset under the TranslationLayer it applies to
virtual_layer, kvo, kernel = valid_kernel
kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path,
'kernel_virtual_offset')
context.config[kvo_path] = kvo
vollog.debug(f"Setting kernel_virtual_offset to {hex(kvo)}")
if kvo is not None:
kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path,
'kernel_virtual_offset')
context.config[kvo_path] = kvo
vollog.debug(f"Setting kernel_virtual_offset to {hex(kvo)}")
def get_physical_layer_name(self, context, vlayer):
return context.config.get(interfaces.configuration.path_join(vlayer.config_path, 'memory_layer'), None)