{"action":"opened","issue":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/160","labels_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/160/labels{/name}","comments_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/160/comments","events_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/160/events","html_url":"https://github.com/volatilityfoundation/volatility/issues/160","id":54087423,"number":160,"title":"Win7 64bit Virtual to Physical Address issue (memmap plugin)","user":{"login":"0xredskull","id":10503312,"avatar_url":"https://avatars.githubusercontent.com/u/10503312?v=3","gravatar_id":"","url":"https://api.github.com/users/0xredskull","html_url":"https://github.com/0xredskull","followers_url":"https://api.github.com/users/0xredskull/followers","following_url":"https://api.github.com/users/0xredskull/following{/other_user}","gists_url":"https://api.github.com/users/0xredskull/gists{/gist_id}","starred_url":"https://api.github.com/users/0xredskull/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0xredskull/subscriptions","organizations_url":"https://api.github.com/users/0xredskull/orgs","repos_url":"https://api.github.com/users/0xredskull/repos","events_url":"https://api.github.com/users/0xredskull/events{/privacy}","received_events_url":"https://api.github.com/users/0xredskull/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-12T18:17:10Z","updated_at":"2015-01-12T18:17:10Z","closed_at":null,"body":"# Virtual to Physical Address works for Win7SP1x86 and WinXP\r\n# Win7-32 bit lsass.exe (pid 528)\r\n$ vol.py -f win7.img --profile=Win7SP1x86 -p 528 dlllist | grep 'kernel32.dll'\r\nVolatility Foundation Volatility Framework 2.4\r\n0x76dc0000    0xd4000     0xffff C:\\Windows\\system32\\kernel32.dll\r\n$ vol.py -f win7.img --profile=Win7SP1x86 -p 528 memmap | egrep '^0x76dc0000'\r\nVolatility Foundation Volatility Framework 2.4\r\n0x76dc0000 0x25fb5000     0x1000       0x1c0000\r\n\r\n# Win7-64 bit lsass.exe (pid 536)\r\n$ vol.py -f win7-64.img --profile=Win7SP1x64 -p 536 dlllist | grep 'kernel32.dll'\r\nVolatility Foundation Volatility Framework 2.4\r\n0x0000000076f90000           0x11f000             0xffff C:\\Windows\\system32\\kernel32.dll\r\n$ vol.py -f win7-64.img --profile=Win7SP1x64 -p 536 memmap | egrep '^0x0000000076f90000'\r\nVolatility Foundation Volatility Framework 2.4\r\n# No matching output for virtual address\r\n"}}