From f61fba8e00f4a710de8bfc641dfd76a88234b98a Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Tue, 5 Feb 2019 21:05:17 -0600 Subject: [PATCH] the vad end should be the last byte in the last page (i.e. ending in 0xfff) --- .../framework/symbols/windows/extensions/__init__.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index f73160103..245a3c07a 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -289,15 +289,16 @@ class _MMVAD_SHORT(objects.Struct): if self.has_member("EndingVpn"): if self.has_member("EndingVpnHigh"): - return (self.EndingVpn.cast("unsigned int") << 12) | (self.EndingVpnHigh.cast("unsigned int") << 44) + return (((self.EndingVpn.cast("unsigned int") + 1) << 12) | (self.EndingVpnHigh.cast("unsigned int") << 44)) - 1 else: return ((self.EndingVpn.cast("unsigned int") + 1) << 12) - 1 elif self.has_member("Core"): - + print(self.Core.EndingVpnHigh) + print(self.Core.EndingVpnHigh.cast("unsigned int")) if self.Core.has_member("EndingVpnHigh"): - return (self.Core.EndingVpn.cast("unsigned int") << 12) | ( - self.Core.EndingVpnHigh.cast("unsigned int") << 44) + return (((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) | ( + self.Core.EndingVpnHigh.cast("unsigned int") << 44)) - 1 else: return ((self.Core.EndingVpn.cast("unsigned int") + 1) << 12) - 1