From 8bc5a4e8986edd1410d9bcaede91ea5af972b18e Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 23 May 2018 19:41:13 +0100
Subject: [PATCH] Ensure maxaddr is never includes the volatile bit.

---
 volatility/framework/layers/registry.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index a93944ce8..d0c96e6b0 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -48,7 +48,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         self._minaddr = 0
         # If there's no base_block, we don't know how big the address space is
         # We also don't know the root_cell_offset, so we use a hardcoded value of 0x20
-        self._maxaddr = self._base_block.Length or 0xffffffff
+        self._maxaddr = self._base_block.Length or 0x7fffffff
 
     @property
     def hive_offset(self) -> int: