diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 68660c41a..bf054a91b 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -972,7 +972,8 @@ class CONTROL_AREA(objects.StructType): # If the entry is not a valid physical address then see if it is in transition. elif mmpte.u.Trans.Transition == 1: - physoffset = (mmpte.u.Trans.PageFrameNumber &~ (0b1111 << 32)) << 12 + # Strips the bit flag in 'PageFrameNumber' for pages in transition state + physoffset = (mmpte.u.Trans.PageFrameNumber & (( 1 << 33 ) - 1 ) ) << 12 yield physoffset, file_offset, self.PAGE_SIZE # Go to the next PTE entry