WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 23:22:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #837 from volatilityfoundation/issues/issue829

Browse Source 
Windows: When constructing a buffer, manually dereference onto the native layer
This commit is contained in:
ikelos
2022-09-21 21:03:29 +01:00
committed by GitHub
parent fe76207d7e 4985dcd9a3
commit 42d0a6cbd2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+1 -1
View File
@@ -488,7 +488,7 @@ class UNICODE_STRING(objects.StructType):
# We manually construct an object rather than casting a dereferenced pointer in case
# the buffer length is 0 and the pointer is a NULL pointer
return self._context.object(self.vol.type_name.split(constants.BANG)[0] + constants.BANG + 'string',
layer_name = self.Buffer.vol.layer_name,
layer_name = self.Buffer.vol.native_layer_name,
offset = self.Buffer,
max_length = self.Length, errors = 'replace', encoding = 'utf16')