From f547d24dd5fc2f7bca2b3ac1f8dd6c8024f7a654 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 16 May 2012 14:33:33 +0000 Subject: [PATCH] XP x86 sockets/sockscan port endianness is backwards --- volatility/plugins/overlays/windows/tcpip_vtypes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/windows/tcpip_vtypes.py b/volatility/plugins/overlays/windows/tcpip_vtypes.py index 794730b4..a9c03bbe 100644 --- a/volatility/plugins/overlays/windows/tcpip_vtypes.py +++ b/volatility/plugins/overlays/windows/tcpip_vtypes.py @@ -12,7 +12,7 @@ tcpip_vtypes = { '_ADDRESS_OBJECT' : [ 0x68, { 'Next' : [ 0x0, ['pointer', ['_ADDRESS_OBJECT']]], 'LocalIpAddress' : [ 0x2c, ['IpAddress']], - 'LocalPort' : [ 0x30, ['unsigned short']], + 'LocalPort' : [ 0x30, ['unsigned be short']], 'Protocol' : [ 0x32, ['unsigned short']], 'Pid' : [ 0x148, ['unsigned long']], 'CreateTime' : [ 0x158, ['WinTimeStamp', {}]],