From 5b044924632ad9f7a37b1af8df1eeea23ea57654 Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Mon, 11 Nov 2019 10:21:14 -0500 Subject: [PATCH] Fix on 'end_bit' computation --- volatility/framework/symbols/intermed.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 591ca26ba..063bf7516 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -369,7 +369,7 @@ class Version1Format(ISFormatTable): elif type_name == 'enum': update = self._lookup_enum(dictionary['name']) elif type_name == 'bitfield': - update = {'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_length']} + update = {'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_position'] + dictionary['bit_length']} update['base_type'] = self._interdict_to_template(dictionary['type']) # We do *not* call native_template.clone(), since it slows everything down a lot # We require that the native.get_type method always returns a newly constructed python object