diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 2b914e1f5..778bf9122 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -126,8 +126,8 @@ class Info(plugins.PluginInterface): yield (0, ("NtProductType", str(kuser.NtProductType.description))) yield (0, ("NtMajorVersion", str(kuser.NtMajorVersion))) yield (0, ("NtMinorVersion", str(kuser.NtMinorVersion))) - # yield (0, ("KdDebuggerEnabled", "True" if ord(kuser.KdDebuggerEnabled) else "False")) - # yield (0, ("SafeBootMode", "True" if ord(kuser.SafeBootMode) else "False")) + # yield (0, ("KdDebuggerEnabled", "True" if kuser.KdDebuggerEnabled else "False")) + # yield (0, ("SafeBootMode", "True" if kuser.SafeBootMode else "False")) dos_header = self.context.object( pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = kvo, layer_name = virtual_layer_name) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 8a77d662f..872a9e06c 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -488,9 +488,9 @@ class _OBJECT_HEADER(objects.Struct): # windows 7 and later have a TypeIndex, but windows 10 # further encodes the index value with nt1!ObHeaderCookie try: - type_index = ((self.vol.offset >> 8) ^ cookie ^ int(self.TypeIndex)) & 0xFF + type_index = ((self.vol.offset >> 8) ^ cookie ^ self.TypeIndex) & 0xFF except AttributeError: - type_index = int(self.TypeIndex) + type_index = self.TypeIndex return type_map.get(type_index) @@ -502,7 +502,7 @@ class _OBJECT_HEADER(objects.Struct): symbol_table_name = self.vol.type_name.split(constants.BANG)[0] try: - header_offset = ord(self.NameInfoOffset) + header_offset = self.NameInfoOffset except AttributeError: # http://codemachine.com/article_objectheader.html (Windows 7 and later) name_info_bit = 0x2 @@ -515,7 +515,7 @@ class _OBJECT_HEADER(objects.Struct): ntkrnlmp = self._context.module(symbol_table_name, layer_name = self.vol.layer_name, offset = kvo) address = ntkrnlmp.get_symbol("ObpInfoMaskToOffset").address - calculated_index = ord(self.InfoMask) & (name_info_bit | (name_info_bit - 1)) + calculated_index = self.InfoMask & (name_info_bit | (name_info_bit - 1)) header_offset = self._context.object( symbol_table_name + constants.BANG + "unsigned char",