Windows: Update get_commit_charge extension to handle Core.CommitChar…

…ge case
eve-mem · Dec 16, 2024 · 4e2227e · 4e2227e
1 parent b6717d8
commit 4e2227e
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -269,7 +269,10 @@ def get_commit_charge(self):
             return self.u.VadFlags.CommitCharge
 
         elif self.has_member("Core"):
-            return self.Core.u1.VadFlags1.CommitCharge
+            if self.Core.has_member("CommitCharge"):
+                return self.Core.CommitCharge
+            else:
+                return self.Core.u1.VadFlags1.CommitCharge
 
         raise AttributeError("Unable to find the commit charge member")