From 85775239b5abbe0fbed07e0b69f1716d9ccd5a70 Mon Sep 17 00:00:00 2001 From: lyles6 Date: Wed, 19 Aug 2020 08:03:45 -0700 Subject: [PATCH] changed back to same format as get_parent --- .../framework/symbols/windows/extensions/__init__.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index c60e625db..d77e0ccdb 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -120,14 +120,15 @@ class MMVAD_SHORT(objects.StructType): elif self.has_member("Right"): return self.Right + # this is for windows 8 and 10 elif self.has_member("VadNode"): if self.VadNode.has_member("RightChild"): return self.VadNode.RightChild if self.VadNode.has_member("Right"): return self.VadNode.Right - # if to avoid MMVAD that has both - if self.has_member("Core"): + # also for windows 8 and 10 + elif self.has_member("Core"): if self.Core.has_member("VadNode"): if self.Core.VadNode.has_member("RightChild"): return self.Core.VadNode.RightChild @@ -145,14 +146,15 @@ class MMVAD_SHORT(objects.StructType): elif self.has_member("Left"): return self.Left + # this is for windows 8 and 10 elif self.has_member("VadNode"): if self.VadNode.has_member("LeftChild"): return self.VadNode.LeftChild if self.VadNode.has_member("Left"): return self.VadNode.Left - # if to avoid MMVAD that has both - if self.has_member("Core"): + # also for windows 8 and 10 + elif self.has_member("Core"): if self.Core.has_member("VadNode"): if self.Core.VadNode.has_member("LeftChild"): return self.Core.VadNode.LeftChild