diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index a93944ce8..d0c96e6b0 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -48,7 +48,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._minaddr = 0 # If there's no base_block, we don't know how big the address space is # We also don't know the root_cell_offset, so we use a hardcoded value of 0x20 - self._maxaddr = self._base_block.Length or 0xffffffff + self._maxaddr = self._base_block.Length or 0x7fffffff @property def hive_offset(self) -> int: