WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refs #21 fix vadinfo's get_private_memory() on 10.0.14393.x

Browse Source
This commit is contained in:
Michael Ligh
2018-04-11 09:24:02 -05:00
parent 470b8e1bea
commit aa774ffca6
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+8 -4
View File
@@ -182,7 +182,7 @@ class _MMVAD_SHORT(objects.Struct):
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"):
return self.u1.VadFlags1.CommitCharge
if hasattr(self, "u") and hasattr(self.u, "VadFlags"):
elif hasattr(self, "u") and hasattr(self.u, "VadFlags"):
return self.u.VadFlags.CommitCharge
elif hasattr(self, "Core"):
@@ -193,14 +193,18 @@ class _MMVAD_SHORT(objects.Struct):
def get_private_memory(self):
"""Get the VAD's private memory setting"""
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"):
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1") and hasattr(self.u1.VadFlags1, "PrivateMemory"):
return self.u1.VadFlags1.PrivateMemory
if hasattr(self, "u") and hasattr(self.u, "VadFlags"):
elif hasattr(self, "u") and hasattr(self.u, "VadFlags") and hasattr(self.u.VadFlags, "PrivateMemory"):
return self.u.VadFlags.PrivateMemory
elif hasattr(self, "Core"):
return self.Core.u1.VadFlags1.PrivateMemory
if hasattr(self.Core, "u1") and hasattr(self.Core.u1, "VadFlags1") and hasattr(self.Core.u1.VadFlags1, "PrivateMemory"):
return self.Core.u1.VadFlags1.PrivateMemory
elif hasattr(self.Core, "u") and hasattr(self.Core.u, "VadFlags") and hasattr(self.Core.u.VadFlags, "PrivateMemory"):
return self.Core.u.VadFlags.PrivateMemory
raise AttributeError("Unable to find the private memory member")