From fbadaa9de97f4f8a61ce3bc012bcc4d65cbda384 Mon Sep 17 00:00:00 2001 From: atcuno Date: Thu, 31 Jan 2013 23:41:20 +0000 Subject: [PATCH] Mac - fix dump_maps --- volatility/plugins/mac/dump_map.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/mac/dump_map.py b/volatility/plugins/mac/dump_map.py index 45d9654f..e832ecfe 100644 --- a/volatility/plugins/mac/dump_map.py +++ b/volatility/plugins/mac/dump_map.py @@ -45,7 +45,7 @@ class mac_dump_maps(proc_maps.mac_proc_maps): size = 0 for proc, map in data: - if not map_address or map_address == start: + if not map_address or map_address == map.links.start: for page in self._read_addr_range(proc, map.links.start, map.links.end): size += len(page) outfile.write(page) @@ -62,4 +62,4 @@ class mac_dump_maps(proc_maps.mac_proc_maps): while start < end: page = proc_as.zread(start, pagesize) yield page - start = start + pagesize \ No newline at end of file + start = start + pagesize