From ccef55e44893aded13250f346524c08edf4c788a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 15:57:18 +0000 Subject: [PATCH] Linux: Use native_layer when constructing from a pointer offset --- volatility/framework/symbols/mac/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 787e7b56d..e433318ae 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType): if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", - layer_name = vnode_object.vol.layer_name, + layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: