diff --git a/volatility/framework/automagic/nlpdtbfinder.py b/volatility/framework/automagic/nlpdtbfinder.py index 3910f8f18..7174608a4 100644 --- a/volatility/framework/automagic/nlpdtbfinder.py +++ b/volatility/framework/automagic/nlpdtbfinder.py @@ -96,7 +96,7 @@ class NlpDtbScanner(interfaces.layers.ScannerInterface): def __call__(self, data: bytes, data_offset: int) \ -> typing.Generator[typing.Tuple[int, typing.List[typing.Tuple[int, int]]], None, None]: - structure = self._layer_class.structure + structure = self._layer_class.structure # type: typing.List[typing.Tuple[str, int, bool]] name, size, large_page = structure[0] # Somewhat hacky means of determining which format string to use diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 9fba3a2d8..8312b697b 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -165,7 +165,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if layer_name and virtual_layer_name: memlayer = context.memory[virtual_layer_name] if isinstance(memlayer, intel.Intel): - page_size = memlayer.page_size + page_size = memlayer.page_size # type: int results = {virtual_layer_name: scan(context, layer_name, page_size, diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 1be06191f..61f8666da 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -496,6 +496,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): raise TypeError("Parent layer is not a translation layer, unable to construct process layer") # Presumably for 64-bit systems, the DTB is defined as an array, rather than an unsigned long long + dtb = 0 # type: int if isinstance(self.Pcb.DirectoryTableBase, objects.Array): dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long") else: