WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up Vad extensions now that Chars are ints rather than bytes.

Browse Source
This commit is contained in:
Mike Auty
2019-02-06 21:08:52 +00:00
parent 9b488f89fd
commit df41a0cf50
1 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+8 -11
View File
@@ -269,17 +269,16 @@ class _MMVAD_SHORT(objects.Struct):
if self.has_member("StartingVpn"):
if self.has_member("StartingVpnHigh"):
return (self.StartingVpn.cast("unsigned int") << 12) | (self.StartingVpnHigh.cast("unsigned int") << 44)
return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44)
else:
return self.StartingVpn.cast("unsigned int") << 12
return self.StartingVpn << 12
elif self.has_member("Core"):
if self.Core.has_member("StartingVpnHigh"):
return (self.Core.StartingVpn.cast("unsigned int") << 12) | (
self.Core.StartingVpnHigh.cast("unsigned int") << 44)
return (self.Core.StartingVpn << 12) | (self.Core.StartingVpnHigh << 44)
else:
return self.Core.StartingVpn.cast("unsigned int") << 12
return self.Core.StartingVpn << 12
raise AttributeError("Unable to find the starting VPN member")
@@ -289,17 +288,15 @@ class _MMVAD_SHORT(objects.Struct):
if self.has_member("EndingVpn"):
if self.has_member("EndingVpnHigh"):
return (((self.EndingVpn.cast("unsigned int") + 1) << 12) |
(self.EndingVpnHigh.cast("unsigned int") << 44)) - 1
return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1
else:
return ((self.EndingVpn.cast("unsigned int") + 1) << 12) - 1
return ((self.EndingVpn + 1) << 12) - 1
elif self.has_member("Core"):
if self.Core.has_member("EndingVpnHigh"):
return (((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) |
(self.Core.EndingVpnHigh.cast("unsigned int") << 44)) - 1
return (((self.Core.EndingVpn + 1) << 12) | (self.Core.EndingVpnHigh << 44)) - 1
else:
return ((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) - 1
return ((self.Core.EndingVpn + 1) << 12) - 1
raise AttributeError("Unable to find the ending VPN member")