From 3da5512fbd3ddd33c61c163c5eea841a1a6a4ddc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 2 Jan 2017 22:21:39 +0000 Subject: [PATCH] Ensure we instantiate on the physical layer, not the existing kernel layer. --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 853c1d261..679f12c68 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -27,7 +27,7 @@ class _EPROCESS(objects.Struct): # Copy the parent's config and then make suitable changes parent_layer = context.memory[self.vol.layer_name] parent_config = parent_layer.build_configuration() - parent_config['memory_layer'] = self.vol.layer_name + parent_config['memory_layer'] = parent_layer.config['memory_layer'] # Presumably for 64-bit systems, the DTB is defined as an array, rather than an unsigned long long if isinstance(self.Pcb.DirectoryTableBase, objects.Array): parent_config['page_map_offset'] = self.Pcb.DirectoryTableBase.cast("unsigned long long")