diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index 1d18924a6..96c66d483 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -176,7 +176,7 @@ class WindowsCrashDump64Layer(WindowsCrashDump32Layer): mapped_offset += length - # Find the last segment in a file which will be at the end or two pages from the end + # Find the last segment in a file which will be at the end or two pages from the end. We multiply by 32 as we want to offset bby words rather than bits if (bit_position == bitmap_len - 1 or bit_position == bitmap_len - 1 -32*0x2000) and current_bit == 1: length = (bit_position - start_position) * 0x1000 segments.append((start_position * 0x1000, mapped_offset, length, length)) diff --git a/volatility/framework/plugins/windows/crashinfo.py b/volatility/framework/plugins/windows/crashinfo.py index 6a8399ad8..22a8e16c0 100644 --- a/volatility/framework/plugins/windows/crashinfo.py +++ b/volatility/framework/plugins/windows/crashinfo.py @@ -23,8 +23,8 @@ class Crashinfo(interfaces.plugins.PluginInterface): ] def _generator(self, layer): - for seg in layer.mapping(0x0, layer.maximum_address, ignore_errors = True): - yield(0,(seg[0],seg[2],seg[1])) + for offset, length, mapped_offset in layer.mapping(0x0, layer.maximum_address, ignore_errors = True): + yield(0,(offset,length,mapped_offset)) def run(self):