From 5906c76b1b9a69f32d652e87ce34ce40cdc82c3d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Jul 2018 21:15:41 +0100 Subject: [PATCH] Fix omission where protect_values became a class method. --- volatility/plugins/windows/malfind.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/windows/malfind.py b/volatility/plugins/windows/malfind.py index 5c9ef1c3a..2dc334d4c 100644 --- a/volatility/plugins/windows/malfind.py +++ b/volatility/plugins/windows/malfind.py @@ -54,7 +54,10 @@ class Malfind(interfaces_plugins.PluginInterface): proc_layer = self.context.memory[proc_layer_name] for vad in proc.get_vad_root().traverse(): - protection_string = vad.get_protection(vadinfo_plugin.protect_values(), vadinfo.winnt_protections) + protection_string = vad.get_protection(vadinfo_plugin.protect_values(self.context, + proc_layer_name, + self.config["nt_symbols"]), + vadinfo.winnt_protections) write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string # the write/exec check applies to everything