WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 06:42:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove ord for unsigned int and don't cast int objects to ints.

Browse Source
This commit is contained in:
Mike Auty
2019-02-24 23:56:34 +00:00
parent d68b94965c
commit e0d2edbca1
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/info.py
+2 -2
View File
@@ -126,8 +126,8 @@ class Info(plugins.PluginInterface):
yield (0, ("NtProductType", str(kuser.NtProductType.description)))
yield (0, ("NtMajorVersion", str(kuser.NtMajorVersion)))
yield (0, ("NtMinorVersion", str(kuser.NtMinorVersion)))
# yield (0, ("KdDebuggerEnabled", "True" if ord(kuser.KdDebuggerEnabled) else "False"))
# yield (0, ("SafeBootMode", "True" if ord(kuser.SafeBootMode) else "False"))
# yield (0, ("KdDebuggerEnabled", "True" if kuser.KdDebuggerEnabled else "False"))
# yield (0, ("SafeBootMode", "True" if kuser.SafeBootMode else "False"))
dos_header = self.context.object(
pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = kvo, layer_name = virtual_layer_name)
volatility/framework/symbols/windows/extensions/__init__.py
+4 -4
View File
@@ -488,9 +488,9 @@ class _OBJECT_HEADER(objects.Struct):
# windows 7 and later have a TypeIndex, but windows 10
# further encodes the index value with nt1!ObHeaderCookie
try:
type_index = ((self.vol.offset >> 8) ^ cookie ^ int(self.TypeIndex)) & 0xFF
type_index = ((self.vol.offset >> 8) ^ cookie ^ self.TypeIndex) & 0xFF
except AttributeError:
type_index = int(self.TypeIndex)
type_index = self.TypeIndex
return type_map.get(type_index)
@@ -502,7 +502,7 @@ class _OBJECT_HEADER(objects.Struct):
symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
try:
header_offset = ord(self.NameInfoOffset)
header_offset = self.NameInfoOffset
except AttributeError:
# http://codemachine.com/article_objectheader.html (Windows 7 and later)
name_info_bit = 0x2
@@ -515,7 +515,7 @@ class _OBJECT_HEADER(objects.Struct):
ntkrnlmp = self._context.module(symbol_table_name, layer_name = self.vol.layer_name, offset = kvo)
address = ntkrnlmp.get_symbol("ObpInfoMaskToOffset").address
calculated_index = ord(self.InfoMask) & (name_info_bit | (name_info_bit - 1))
calculated_index = self.InfoMask & (name_info_bit | (name_info_bit - 1))
header_offset = self._context.object(
symbol_table_name + constants.BANG + "unsigned char",