Update volatility3/framework/plugins/windows/etwpatch.py

Co-authored-by: ikelos <ikelos@users.noreply.github.com>
2026-09-13 05:07:38 +02:00 · 2025-04-29 13:11:35 +03:00
parent 281a237e03
commit 39b35a3a80
1 changed files with 2 additions and 2 deletions
@@ -86,8 +86,8 @@ class EtwPatch(interfaces.plugins.PluginInterface):

            # Map of opcodes to their instruction names
            opcode_map = {
-                "c3": "RET",
-                "e9": "JMP",
+                0xc3: "RET",
+                0xe9: "JMP",
            }

            for dll_name, functions in found_symbols.items():