WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #970 from volatilityfoundation/issues/issue969

Browse Source 
Windows: Fix VAD offset canonicalization
This commit is contained in:
ikelos
2023-06-16 19:01:21 +01:00
committed by GitHub
parent 2e577790d2 aa04b8ca3d
commit e17cb1532b
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/vadinfo.py
+2 -1
View File
@@ -198,6 +198,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
def _generator(self, procs):
kernel = self.context.modules[self.config["kernel"]]
kernel_layer = self.context.layers[kernel.layer_name]
def passthrough(_: interfaces.objects.ObjectInterface) -> bool:
return False
@@ -229,7 +230,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
(
proc.UniqueProcessId,
process_name,
format_hints.Hex(vad.vol.offset),
format_hints.Hex(kernel_layer.canonicalize(vad.vol.offset)),
format_hints.Hex(vad.get_start()),
format_hints.Hex(vad.get_end()),
vad.get_tag(),