From f17907200ddde0a4b9cf64581a841fadb034d39e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 21:26:58 +0000 Subject: [PATCH] No longer allocate session modules in support of the GUI objects at offset 0. Instantiate objects at the absolute address explicility. --- volatility3/framework/plugins/windows/windowstations.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index 0ca92eb97..cd02938cd 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -115,7 +115,9 @@ class WindowStations(interfaces.plugins.PluginInterface): for session_id, session_layer in session_map.items(): session_module = context.module( - gui_table_name, layer_name=session_layer, offset=0 + gui_table_name, + layer_name=session_layer, + offset=context.modules[module_name].offset, ) session_map[session_id] = session_module @@ -177,7 +179,9 @@ class WindowStations(interfaces.plugins.PluginInterface): if session_module: # create the object its own address space (per-session) yield session_module.object( - object_type=object_type, offset=mem_object.vol.offset + object_type=object_type, + offset=mem_object.vol.offset, + absolute=True, ) @classmethod