From 648cded5e17ce97275710b61f3da432c13da57b2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 13 Nov 2019 16:48:14 +0000 Subject: [PATCH] Objects: Fix incorrect Bitfield maths Turns out that #133 exposed a mistake in how we were using the end_bit field (and it should have been picked up in review, my bad). Essentially we were masking based on the length of the end_bit after *already* shifting by the start_bit. We should mask then shift, not the other way around. May well fix issue #135 (pdb generation will have been affected by this). --- volatility/framework/objects/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 961a7b7c1..1e1c2f788 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -367,7 +367,7 @@ class BitField(interfaces.objects.ObjectInterface, int): end_bit: int = 0, **kwargs) -> 'BitField': value = base_type(context = context, object_info = object_info) - return int.__new__(cls, (value >> start_bit) & ((1 << end_bit) - 1)) # type: ignore + return int.__new__(cls, ((value & ((1 << end_bit) - 1)) >> start_bit)) # type: ignore def write(self, value): raise NotImplementedError("Writing to BitFields is not yet implemented")