diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 35126ba72..0464621a9 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -135,8 +135,8 @@ class Malfind(interfaces.plugins.PluginInterface): if self.config['dump']: file_output = "Error outputting to file" try: - filedata = vadinfo.VadInfo.vad_dump(self.context, proc, vad) - file_output = filedata.preferred_name + filedata = vadinfo.VadInfo.vad_dump(self.context, proc, vad, self._file_handler) + file_output = filedata.preferred_filename except (exceptions.InvalidAddressException, OverflowError) as excp: vollog.debug("Unable to dump PE with pid {0}.{1:#x}: {2}".format(proc.UniqueProcessId, vad.get_start(), excp)) diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index fe37eeb98..16ac8e638 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -191,7 +191,7 @@ class VadInfo(interfaces.plugins.PluginInterface): filedata = self.vad_dump(self.context, proc, vad, self._file_handler) file_output = "Error outputting file" if filedata: - file_output = filedata.preferred_name + file_output = filedata.preferred_filename yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(vad.vol.offset), format_hints.Hex(vad.get_start()), format_hints.Hex(vad.get_end()), vad.get_tag(),