From a795a7e2d5204cff4f140cf942dabb73c67e95a0 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 14 Jul 2021 20:45:43 +1000 Subject: [PATCH] Using double underscore in the find() will also include edge cases like when the calling class contains an underscore i.e. THE_CLASS --- volatility3/framework/objects/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index f9c87931c..3f2e70b02 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -738,7 +738,7 @@ class AggregateType(interfaces.objects.ObjectInterface): if attr in self._concrete_members: return self._concrete_members[attr] if attr.startswith("_") and not attr.startswith("__") and "__" in attr: - attr = attr[attr.find("_", 1):] # See issue #522 + attr = attr[attr.find("__", 1):] # See issue #522 if attr in self.vol.members: mask = self._context.layers[self.vol.layer_name].address_mask relative_offset, template = self.vol.members[attr]