From d4e12c982d0e3c3873e666ae44cc339215690364 Mon Sep 17 00:00:00 2001 From: Analyst Date: Wed, 27 Feb 2019 10:45:36 -0600 Subject: [PATCH] fix a critical issue determining the names of windows kernel objects from the object header --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 872a9e06c..cec117deb 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -520,7 +520,7 @@ class _OBJECT_HEADER(objects.Struct): header_offset = self._context.object( symbol_table_name + constants.BANG + "unsigned char", layer_name = self.vol.native_layer_name, - offset = address + calculated_index) + offset = kvo + address + calculated_index) header = self._context.object( symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO",