From 3318e9c4a57e8c1a89e4325afa2cdd49c4ae667e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 8 Sep 2019 01:58:46 +0100 Subject: [PATCH] Fix a typo introduced in 5362e2094edbe2fce8b9256577a0753e175b9dcb. --- volatility/framework/plugins/windows/handles.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index ee35de483..4dd3350ee 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -216,7 +216,8 @@ class Handles(interfaces_plugins.PluginInterface): if not self.context.layers[virtual].is_valid(offset): return - table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count)) + table = ntkrnlmp.object( + object_type = "array", offset = offset, subtype = subtype, count = int(count), absolute = True) layer_object = self.context.layers[virtual] masked_offset = (offset & layer_object.maximum_address)