From 989f08eff2306ede84bddcb6590a6e9b0126eb5f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 9 Nov 2019 16:06:30 +0000 Subject: [PATCH] Revert "EPROCESS: Fix is_valid check missing cast." This reverts commit 60eda0a52bb4eca3f82ea6cb6bde88877b53eee9. Turns out, this is pull request #110, only done worse. --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 0b81e3b41..c937d8d09 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -696,7 +696,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): return False # check for all 0s besides the PCID entries - if self.Pcb.DirectoryTableBase.cast("unsigned long long") & ~0xfff == 0: + if self.Pcb.DirectoryTableBase & ~0xfff == 0: return False ## TODO: we can also add the thread Flink and Blink tests if necessary