From a0edd1e38e8a22678d523d36f1a36a98e430af9e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Fri, 15 Jun 2018 22:42:09 -0500 Subject: [PATCH] root_cell_offset changes seem to have fixed maxaddr problems --- volatility/framework/layers/registry.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 8dc956929..1146bc14c 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -63,9 +63,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._minaddr = 0 # If there's no base_block, we don't know how big the address space is # We also don't know the root_cell_offset, so we use a hardcoded value of 0x20 - # FIXME: using BaseBlock.Length runs into issues - # self._maxaddr = self._base_block.Length or 0x7fffffff - self._maxaddr = 0x7fffffff + self._maxaddr = self._base_block.Length or 0x7fffffff @property def hive_offset(self) -> int: