WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

define a find_address() method for consistent behavior for 32 and 64-bit systems

Browse Source
This commit is contained in:
Michael Ligh
2018-08-29 15:10:46 +01:00
committed by ikelos
parent 45ea3437f1
commit ea63c7e80e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/ssdt.py
+3 -3
View File
@@ -64,8 +64,10 @@ class SSDT(plugins.PluginInterface):
is_kernel_64 = ntkrnlmp.get_type("pointer").size == 8
if is_kernel_64:
array_subtype = "long"
find_address = lambda func: kvo + service_table_address + (func >> 4)
else:
array_subtype = "unsigned long"
find_address = lambda func: func
functions = ntkrnlmp.object(type_name="array", offset=kvo + service_table_address,
subtype=ntkrnlmp.get_type(array_subtype),
@@ -73,9 +75,7 @@ class SSDT(plugins.PluginInterface):
for idx, function in enumerate(functions):
if is_kernel_64:
function = kvo + service_table_address + (function >> 4)
function = find_address(function)
module_symbols = collection.get_module_symbols_by_absolute_location(function)
for module_name, symbol_generator in module_symbols: