From 63787acb50cef77f5a7c4e8e50eb531dc8ff6076 Mon Sep 17 00:00:00 2001 From: Analyst Date: Sun, 24 Feb 2019 15:24:37 -0600 Subject: [PATCH] fix the handling of TypeInfo after 9b488f8 --- volatility/framework/symbols/windows/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 2ad81ebe8..c330ea85a 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -488,9 +488,9 @@ class _OBJECT_HEADER(objects.Struct): # windows 7 and later have a TypeIndex, but windows 10 # further encodes the index value with nt1!ObHeaderCookie try: - type_index = ((self.vol.offset >> 8) ^ cookie ^ ord(self.TypeIndex)) & 0xFF + type_index = ((self.vol.offset >> 8) ^ cookie ^ int(self.TypeIndex)) & 0xFF except AttributeError: - type_index = ord(self.TypeIndex) + type_index = int(self.TypeIndex) return type_map.get(type_index)