From 61d4ee3c0edcd4810a74eeb584d3291b59065535 Mon Sep 17 00:00:00 2001 From: cecio Date: Tue, 8 Sep 2020 23:33:06 +0200 Subject: [PATCH] some mods in comments --- volatility/framework/plugins/windows/psscan.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index 846079804..9a762127b 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -85,7 +85,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): proc: the process object with phisical address Returns: - A process object on virtual address space + A process object on virtual address layer """ @@ -115,10 +115,10 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): offset = proc.ThreadListHead.Flink - ofs, absolute = True) - # Ask for the thread's process to get an _EPROCESS with a virtual address space + # Ask for the thread's process to get an _EPROCESS with a virtual address layer virtual_process = ethread.owning_process() # Sanity check the bounce. - # This compares the original offset with the new one (translated from virtual space) + # This compares the original offset with the new one (translated from virtual layer) (_, _, ph_offset, _, _) = list(context.layers[layer_name].mapping(offset = virtual_process.vol.offset, length = 0))[0] if virtual_process and \