From b04329e2e997807bea19f3382b15d0517fa26f98 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 8 Sep 2020 02:23:32 +0100 Subject: [PATCH] Poolscanner: Ensure File.Buffer checks right layer --- volatility/framework/symbols/windows/extensions/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index ccd8c7100..2710db0f7 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -353,7 +353,8 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: """Determine if the object is valid.""" - return self.FileName.Length > 0 and self._context.layers[self.vol.layer_name].is_valid(self.FileName.Buffer) + return self.FileName.Length > 0 and self._context.layers[self.FileName.Buffer.vol.native_layer_name].is_valid( + self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: name = renderers.UnreadableValue() # type: Union[str, interfaces.renderers.BaseAbsentValue]