From 76f5d3549936004d8313c94dbf6fa53a0ba88f02 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Mon, 11 Jun 2018 21:25:01 -0500 Subject: [PATCH] update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols" --- volatility/framework/symbols/windows/extensions/kdbg.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility/framework/symbols/windows/extensions/kdbg.py index 1ab333487..5dc41fdbe 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility/framework/symbols/windows/extensions/kdbg.py @@ -7,12 +7,10 @@ class _KDDEBUGGER_DATA64(objects.Struct): """Returns the NT build lab string from the KDBG""" layer_name = self.vol.layer_name - nt_symbol_name = self.get_symbol_table().table_mapping["nt_symbols"] + symbol_table_name = self.get_symbol_table().name - kvo = self._context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self._context.module(nt_symbol_name, layer_name=layer_name, offset=kvo) - - return ntkrnlmp.object(type_name="string", + return self._context.object(symbol_table_name + constants.BANG + "string", + layer_name=layer_name, offset=self.NtBuildLab, max_length=32, errors="replace")