WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 04:24:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

changed back to same format as get_parent

Browse Source
This commit is contained in:
lyles6
2020-09-10 09:13:31 +01:00
committed by ikelos
parent 720f46a962
commit 85775239b5
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+6 -4
View File
@@ -120,14 +120,15 @@ class MMVAD_SHORT(objects.StructType):
elif self.has_member("Right"):
return self.Right
# this is for windows 8 and 10
elif self.has_member("VadNode"):
if self.VadNode.has_member("RightChild"):
return self.VadNode.RightChild
if self.VadNode.has_member("Right"):
return self.VadNode.Right
# if to avoid MMVAD that has both
if self.has_member("Core"):
# also for windows 8 and 10
elif self.has_member("Core"):
if self.Core.has_member("VadNode"):
if self.Core.VadNode.has_member("RightChild"):
return self.Core.VadNode.RightChild
@@ -145,14 +146,15 @@ class MMVAD_SHORT(objects.StructType):
elif self.has_member("Left"):
return self.Left
# this is for windows 8 and 10
elif self.has_member("VadNode"):
if self.VadNode.has_member("LeftChild"):
return self.VadNode.LeftChild
if self.VadNode.has_member("Left"):
return self.VadNode.Left
# if to avoid MMVAD that has both
if self.has_member("Core"):
# also for windows 8 and 10
elif self.has_member("Core"):
if self.Core.has_member("VadNode"):
if self.Core.VadNode.has_member("LeftChild"):
return self.Core.VadNode.LeftChild