From 60eda0a52bb4eca3f82ea6cb6bde88877b53eee9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 9 Nov 2019 15:56:19 +0000 Subject: [PATCH] EPROCESS: Fix is_valid check missing cast. --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index c937d8d09..0b81e3b41 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -696,7 +696,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): return False # check for all 0s besides the PCID entries - if self.Pcb.DirectoryTableBase & ~0xfff == 0: + if self.Pcb.DirectoryTableBase.cast("unsigned long long") & ~0xfff == 0: return False ## TODO: we can also add the thread Flink and Blink tests if necessary