From 9c1603e37259b1472ea6bb98948d643542eee0f5 Mon Sep 17 00:00:00 2001 From: Frank Block Date: Thu, 11 Mar 2021 23:55:37 +0100 Subject: [PATCH] Added Comment/TODO for transition state issue See https://github.com/volatilityfoundation/volatility3/pull/475 --- .../framework/symbols/windows/extensions/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index bf054a91b..997175fba 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -972,8 +972,12 @@ class CONTROL_AREA(objects.StructType): # If the entry is not a valid physical address then see if it is in transition. elif mmpte.u.Trans.Transition == 1: - # Strips the bit flag in 'PageFrameNumber' for pages in transition state + # TODO: Fix appropriately in a future release. + # Currently just a temprorary workaround to deal with custom bit flag + # in the PFN field for pages in transition state. + # See https://github.com/volatilityfoundation/volatility3/pull/475 physoffset = (mmpte.u.Trans.PageFrameNumber & (( 1 << 33 ) - 1 ) ) << 12 + yield physoffset, file_offset, self.PAGE_SIZE # Go to the next PTE entry