diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 4403e7c2c..6cd453550 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -54,8 +54,7 @@ class VadInfo(interfaces.plugins.PluginInterface): requirements.IntRequirement( name="address", description="Process virtual memory address to include " - "(all other address ranges are excluded). This must be " - "a base address, not an address within the desired range.", + "(all other address ranges are excluded).", optional=True, ), requirements.ListRequirement( @@ -207,7 +206,7 @@ class VadInfo(interfaces.plugins.PluginInterface): if self.config.get("address", None) is not None: def filter_function(x: interfaces.objects.ObjectInterface) -> bool: - return x.get_start() not in [self.config["address"]] + return not (x.get_start() <= self.config['address'] <= x.get_end()) filter_func = filter_function