From 949a2a2ddcf44fda9faaad6bd2e2db69d65b8e83 Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Mon, 2 Dec 2019 05:40:06 -0500 Subject: [PATCH] Change unsigned long long by pointer --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 80316d33c..36f96f890 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -694,7 +694,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): # check for all 0s besides the PCID entries if isinstance(self.Pcb.DirectoryTableBase, objects.Array): - dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long") + dtb = self.Pcb.DirectoryTableBase.cast("pointer") else: dtb = self.Pcb.DirectoryTableBase