From 6b9ec5a0798701cb81e42636945cd08596c6eadd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 8 Sep 2020 02:45:20 +0100 Subject: [PATCH] Poolscanner: More native_layer validity checks --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 2710db0f7..a65483d24 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -359,7 +359,7 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: name = renderers.UnreadableValue() # type: Union[str, interfaces.renderers.BaseAbsentValue] - if self._context.layers[self.vol.layer_name].is_valid(self.DeviceObject): + if self._context.layers[self.DeviceObject.vol.native_layer_name].is_valid(self.DeviceObject): try: name = "\\Device\\{}".format(self.DeviceObject.get_device_name()) except ValueError: