From acb088dbcdb8532e643a72fb4571ae1cba24786c Mon Sep 17 00:00:00 2001 From: k1nd0ne Date: Sun, 3 Dec 2023 13:05:45 +0100 Subject: [PATCH] Better code reading --- volatility3/framework/plugins/windows/mftscan.py | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 4d58eb1e2..7e4e1ca18 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -258,17 +258,14 @@ class ADS(interfaces.plugins.PluginInterface): content = attr.get_resident_filecontent() if content: # Preparing for Disassembly + disasm = interfaces.renderers.BaseAbsentValue architecture = layer.metadata.get( "architecture", None ) - - disasm = ( - interfaces.renderers.Disassembly( + if architecture: + disasm = interfaces.renderers.Disassembly( content, 0, architecture.lower() ) - if architecture - else interfaces.renderers.BaseAbsentValue - ) else: content = renderers.NotAvailableValue disasm = interfaces.renderers.BaseAbsentValue