Skip to content

Commit 87cc571

Browse files
committed
ShimcacheMem: Fix symbol table
These SHIM_CACHE_ENTRY offsets aren't correct - should be identical to those in the other XP symbol tables.
1 parent 1b31357 commit 87cc571

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -331,23 +331,23 @@
331331
"LastModified": {
332332
"type": {
333333
"kind": "union",
334-
"name": "LARGE_INTEGER"
334+
"name": "_LARGE_INTEGER"
335335
},
336-
"offset": 4
336+
"offset": 528
337337
},
338338
"FileSize": {
339339
"type": {
340340
"kind": "base",
341341
"name": "long long"
342342
},
343-
"offset": 8
343+
"offset": 536
344344
},
345345
"LastUpdate": {
346346
"type": {
347347
"kind": "union",
348-
"name": "LARGE_INTEGER"
348+
"name": "_LARGE_INTEGER"
349349
},
350-
"offset": 12
350+
"offset": 544
351351
}
352352
},
353353
"kind": "struct",

0 commit comments

Comments
 (0)