From 87cc571fbba8d6d04aecda758f36729fba44b0ec Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Mon, 14 Apr 2025 10:18:17 -0500
Subject: [PATCH] ShimcacheMem: Fix symbol table

These SHIM_CACHE_ENTRY offsets aren't correct - should be identical to
those in the other XP symbol tables.
---
 .../windows/shimcache/shimcache-xp-sp2-x86.json        | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json
index 6114e6c85..6c990f9f5 100644
--- a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json
+++ b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json
@@ -331,23 +331,23 @@
                 "LastModified": {
                     "type": {
                         "kind": "union",
-                        "name": "LARGE_INTEGER"
+                        "name": "_LARGE_INTEGER"
                     },
-                    "offset": 4
+                    "offset": 528
                 },
                 "FileSize": {
                     "type": {
                         "kind": "base",
                         "name": "long long"
                     },
-                    "offset": 8
+                    "offset": 536
                 },
                 "LastUpdate": {
                     "type": {
                         "kind": "union",
-                        "name": "LARGE_INTEGER"
+                        "name": "_LARGE_INTEGER"
                     },
-                    "offset": 12
+                    "offset": 544
                 }
             },
             "kind": "struct",