Windows: Fix VAD offset canonicalization #969

2026-09-27 20:14:51 +02:00 · 2023-06-16 18:03:07 +01:00
parent 2e577790d2
commit aa04b8ca3d
1 changed files with 2 additions and 1 deletions
@@ -198,6 +198,7 @@ class VadInfo(interfaces.plugins.PluginInterface):

    def _generator(self, procs):
        kernel = self.context.modules[self.config["kernel"]]
+        kernel_layer = self.context.layers[kernel.layer_name]

        def passthrough(_: interfaces.objects.ObjectInterface) -> bool:
            return False
@@ -229,7 +230,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
                    (
                        proc.UniqueProcessId,
                        process_name,
-                        format_hints.Hex(vad.vol.offset),
+                        format_hints.Hex(kernel_layer.canonicalize(vad.vol.offset)),
                        format_hints.Hex(vad.get_start()),
                        format_hints.Hex(vad.get_end()),
                        vad.get_tag(),