mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-11 20:27:38 +02:00
Windows: Use device offsets instead of driver offsets
This updates the `devicetree` plugin to return the virtual offsets of the device objects themselves instead of that of their parent driver.
This commit is contained in:
@@ -138,7 +138,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
|
||||
yield (
|
||||
1,
|
||||
(
|
||||
format_hints.Hex(driver.vol.offset),
|
||||
format_hints.Hex(device.vol.offset),
|
||||
"DEV",
|
||||
driver_name,
|
||||
device_name,
|
||||
@@ -170,7 +170,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
|
||||
yield (
|
||||
level,
|
||||
(
|
||||
format_hints.Hex(driver.vol.offset),
|
||||
format_hints.Hex(attached_device.vol.offset),
|
||||
"ATT",
|
||||
driver_name,
|
||||
device_name,
|
||||
|
||||
Reference in New Issue
Block a user