WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change pending checking and OS version

Browse Source
This commit is contained in:
Andrew Case
2025-03-24 20:19:59 -05:00
parent 1a2427b54b
commit 3a4e622854
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/processghosting.py
+2 -2
View File
@@ -99,7 +99,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
except exceptions.InvalidAddressException:
delete_pending = None
if delete_pending and delete_pending == 1:
if delete_pending == 1:
yield file_object.vol.offset, delete_pending, None
@classmethod
@@ -158,7 +158,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
)
if not has_imagefilepointer:
vollog.warning(
"ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present"
"ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present"
)
for proc in procs: