diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 80316d33c..36f96f890 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -694,7 +694,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): # check for all 0s besides the PCID entries if isinstance(self.Pcb.DirectoryTableBase, objects.Array): - dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long") + dtb = self.Pcb.DirectoryTableBase.cast("pointer") else: dtb = self.Pcb.DirectoryTableBase