From 9d8837108aacb1807bfeba2de7fb29a99f8fbdbc Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 16 May 2012 16:37:50 +0000 Subject: [PATCH] make sure to dereference sock.Next and conn.Next, otherwise it will appear as if multiple socket and connection objects have different members but the same offset since sock.obj_offset == sock.Next.obj_offset. Fixes Issue #244. Fixes Issue #258. --- volatility/win32/network.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/win32/network.py b/volatility/win32/network.py index c6e05fb9..16085fba 100644 --- a/volatility/win32/network.py +++ b/volatility/win32/network.py @@ -168,7 +168,7 @@ def determine_connections(addr_space): while conn.is_valid() and conn.obj_offset not in seen: yield conn seen.add(conn.obj_offset) - conn = conn.Next + conn = conn.Next.dereference() def determine_sockets(addr_space): """Determines all sockets for each module""" @@ -207,4 +207,4 @@ def determine_sockets(addr_space): while sock.is_valid() and sock.obj_offset not in seen: yield sock seen.add(sock.obj_offset) - sock = sock.Next + sock = sock.Next.dereference()