We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 4738efe commit 19b094aCopy full SHA for 19b094a
volatility3/framework/plugins/windows/etwpatch.py
@@ -86,17 +86,16 @@ def _generator(self):
86
87
# Map of opcodes to their instruction names
88
opcode_map = {
89
- 0xc3: "RET",
90
- 0xe9: "JMP",
+ 0xC3: "RET",
+ 0xE9: "JMP",
91
}
92
93
for dll_name, functions in found_symbols.items():
94
for func_name, func_addr in functions:
95
try:
96
- opcode = (
97
- self.context.layers[proc_layer_name]
98
- .read(func_addr, 1)[0]
99
- )
+ opcode = self.context.layers[proc_layer_name].read(
+ func_addr, 1
+ )[0]
100
if opcode in opcode_map:
101
instruction = opcode_map[opcode]
102
yield (
0 commit comments