From b312a5780ccc19f7c672d3b08d10e64da59cf0ab Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 30 May 2022 08:56:27 +0900 Subject: [PATCH] Fix: address mask from @ikelos help --- volatility3/framework/plugins/windows/vadwalk.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index 942cef357..1090ed554 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -40,7 +40,7 @@ class VadWalk(interfaces.plugins.PluginInterface): yield(0, (proc.UniqueProcessId, utility.array_to_string(proc.ImageFileName), format_hints.Hex(vad.vol.offset), - format_hints.Hex(vad.get_parent()), + format_hints.Hex(vad.get_parent() & self.context.layers[vad.vol.layer_name].address_mask), format_hints.Hex(vad.get_left_child()), format_hints.Hex(vad.get_right_child()), format_hints.Hex(vad.get_start()),