From 4e2227e2643b52d2a6f660f62c058ba85526123b Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 16 Dec 2024 17:54:01 +0000 Subject: [PATCH] Windows: Update get_commit_charge extension to handle Core.CommitCharge case --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 793e506c3..ff6d14a8c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -269,7 +269,10 @@ class MMVAD_SHORT(objects.StructType): return self.u.VadFlags.CommitCharge elif self.has_member("Core"): - return self.Core.u1.VadFlags1.CommitCharge + if self.Core.has_member("CommitCharge"): + return self.Core.CommitCharge + else: + return self.Core.u1.VadFlags1.CommitCharge raise AttributeError("Unable to find the commit charge member")