WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

the vad end should be the last byte in the last page (i.e. ending in 0xfff)

Browse Source
This commit is contained in:
Michael Ligh
2019-02-05 21:05:17 -06:00
parent 4c2a29ae01
commit f61fba8e00
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+5 -4
View File
@@ -289,15 +289,16 @@ class _MMVAD_SHORT(objects.Struct):
if self.has_member("EndingVpn"):
if self.has_member("EndingVpnHigh"):
return (self.EndingVpn.cast("unsigned int") << 12) | (self.EndingVpnHigh.cast("unsigned int") << 44)
return (((self.EndingVpn.cast("unsigned int") + 1) << 12) | (self.EndingVpnHigh.cast("unsigned int") << 44)) - 1
else:
return ((self.EndingVpn.cast("unsigned int") + 1) << 12) - 1
elif self.has_member("Core"):
print(self.Core.EndingVpnHigh)
print(self.Core.EndingVpnHigh.cast("unsigned int"))
if self.Core.has_member("EndingVpnHigh"):
return (self.Core.EndingVpn.cast("unsigned int") << 12) | (
self.Core.EndingVpnHigh.cast("unsigned int") << 44)
return (((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) | (
self.Core.EndingVpnHigh.cast("unsigned int") << 44)) - 1
else:
return ((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) - 1