WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400

Browse Source 
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
This commit is contained in:
ikelos
2025-01-31 16:44:24 +00:00
committed by GitHub
parent 68c8b2389a e9d1831a7c
commit b51acfd3fb
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+8 -2
View File
@@ -262,14 +262,20 @@ class MMVAD_SHORT(objects.StructType):
def get_commit_charge(self):
"""Get the VAD's commit charge (number of committed pages)"""
if self.has_member("u1") and self.u1.has_member("VadFlags1"):
if self.has_member("CommitCharge"):
return self.CommitCharge
elif self.has_member("u1") and self.u1.has_member("VadFlags1"):
return self.u1.VadFlags1.CommitCharge
elif self.has_member("u") and self.u.has_member("VadFlags"):
return self.u.VadFlags.CommitCharge
elif self.has_member("Core"):
return self.Core.u1.VadFlags1.CommitCharge
if self.Core.has_member("CommitCharge"):
return self.Core.CommitCharge
else:
return self.Core.u1.VadFlags1.CommitCharge
raise AttributeError("Unable to find the commit charge member")