From 4e2227e2643b52d2a6f660f62c058ba85526123b Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 16 Dec 2024 17:54:01 +0000 Subject: [PATCH 1/2] Windows: Update get_commit_charge extension to handle Core.CommitCharge case --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 793e506c3..ff6d14a8c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -269,7 +269,10 @@ class MMVAD_SHORT(objects.StructType): return self.u.VadFlags.CommitCharge elif self.has_member("Core"): - return self.Core.u1.VadFlags1.CommitCharge + if self.Core.has_member("CommitCharge"): + return self.Core.CommitCharge + else: + return self.Core.u1.VadFlags1.CommitCharge raise AttributeError("Unable to find the commit charge member") From e9d1831a7cbc7dd27e60d4d772a09a6df4e767c5 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 31 Jan 2025 14:45:28 +0000 Subject: [PATCH 2/2] Windows: update get_commit_charge with CommitCharge fix by BeanBagKing --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ff6d14a8c..26007a37a 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -262,7 +262,10 @@ class MMVAD_SHORT(objects.StructType): def get_commit_charge(self): """Get the VAD's commit charge (number of committed pages)""" - if self.has_member("u1") and self.u1.has_member("VadFlags1"): + if self.has_member("CommitCharge"): + return self.CommitCharge + + elif self.has_member("u1") and self.u1.has_member("VadFlags1"): return self.u1.VadFlags1.CommitCharge elif self.has_member("u") and self.u.has_member("VadFlags"):