Skip to content

Commit 239e164

Browse files
committed
Windows: Fix strings plugin missing kernel pages
@eve-mem spotted that we were only recording the first kernel page in any contiguous set of kernel pages, thus missing some results. This should now be fixed.
1 parent 6c0ce1d commit 239e164

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

volatility3/framework/plugins/windows/strings.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,9 +149,9 @@ def generate_mapping(
149149
for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors=True):
150150
offset, _, mapped_offset, mapped_size, maplayer = mapval
151151
for val in range(mapped_offset, mapped_offset + mapped_size, 0x1000):
152-
cur_set = reverse_map.get(mapped_offset >> 12, set())
152+
cur_set = reverse_map.get(val >> 12, set())
153153
cur_set.add(("kernel", offset))
154-
reverse_map[mapped_offset >> 12] = cur_set
154+
reverse_map[val >> 12] = cur_set
155155
if progress_callback:
156156
progress_callback(
157157
(offset * 100) / layer.maximum_address,

0 commit comments

Comments
 (0)