WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-01 04:39:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change calculations to not alter original values for clarity.

Browse Source
This commit is contained in:
Mike Auty
2019-07-30 22:14:19 +01:00
committed by ikelos
parent bd2e948d9e
commit 0302f4b96a
1 changed files with 10 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/mspdb.py
+10 -12
View File
@@ -721,14 +721,12 @@ class PdbReader:
leaf_type = self.context.object(
module.get_enumeration("LEAF_TYPE"), layer_name = module._layer_name, offset = offset)
consumed = leaf_type.vol.base_type.size
offset += consumed
length -= consumed
if leaf_type in [
leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST,
leaf_type.LF_INTERFACE
]:
structure = module.object(type_name = "LF_STRUCTURE", offset = offset)
structure = module.object(type_name = "LF_STRUCTURE", offset = offset + consumed)
name_offset = structure.name.vol.offset - structure.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, structure.size, module, length - name_offset)
structure.size = value
@@ -736,7 +734,7 @@ class PdbReader:
consumed = length
result = leaf_type, name, structure
elif leaf_type in [leaf_type.LF_MEMBER, leaf_type.LF_MEMBER_ST]:
member = module.object(type_name = "LF_MEMBER", offset = offset)
member = module.object(type_name = "LF_MEMBER", offset = offset + consumed)
name_offset = member.name.vol.offset - member.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, member.offset, module, length - name_offset)
member.offset = value
@@ -744,12 +742,12 @@ class PdbReader:
result = leaf_type, name, member
consumed += member.vol.size + len(name) + 1 + excess
elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_POINTER, leaf_type.LF_PROCEDURE]:
obj = module.object(type_name = leaf_type.lookup(), offset = offset)
obj = module.object(type_name = leaf_type.lookup(), offset = offset + consumed)
result = leaf_type, None, obj
consumed = length
elif leaf_type in [leaf_type.LF_FIELDLIST]:
sub_length = length
sub_offset = offset
sub_length = length - consumed
sub_offset = offset + consumed
fields = []
while length > consumed:
subfield, sub_consumed = self.consume_type(module, sub_offset, sub_length)
@@ -760,11 +758,11 @@ class PdbReader:
fields.append(subfield)
result = leaf_type, None, fields
elif leaf_type in [leaf_type.LF_BITFIELD]:
bitfield = module.object(type_name = "LF_BITFIELD", offset = offset)
bitfield = module.object(type_name = "LF_BITFIELD", offset = offset + consumed)
result = leaf_type, None, bitfield
consumed = length
elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]:
array = module.object(type_name = "LF_ARRAY", offset = offset)
array = module.object(type_name = "LF_ARRAY", offset = offset + consumed)
name_offset = array.name.vol.offset - array.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, array.size, module, length - name_offset)
array.size = value
@@ -772,14 +770,14 @@ class PdbReader:
result = leaf_type, name, array
consumed = length
elif leaf_type in [leaf_type.LF_ARGLIST, leaf_type.LF_ENUM]:
enum = module.object(type_name = "LF_ENUM", offset = offset)
enum = module.object(type_name = "LF_ENUM", offset = offset + consumed)
name_offset = enum.name.vol.offset - enum.vol.offset
name = self.parse_string(enum.name, leaf_type < leaf_type.LF_ST_MAX, size = length - name_offset)
enum.name = name # type: Union[str, interfaces.objects.ObjectInterface]
result = leaf_type, name, enum
consumed = length
elif leaf_type in [leaf_type.LF_ENUMERATE]:
enum = module.object(type_name = 'LF_ENUMERATE', offset = offset)
enum = module.object(type_name = 'LF_ENUMERATE', offset = offset + consumed)
name_offset = enum.name.vol.offset - enum.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, enum.value, module, length - name_offset)
enum.value = value
@@ -787,7 +785,7 @@ class PdbReader:
result = leaf_type, name, enum
consumed += enum.vol.size + len(name) + 1 + excess
elif leaf_type in [leaf_type.LF_UNION]:
union = module.object(type_name = "LF_UNION", offset = offset)
union = module.object(type_name = "LF_UNION", offset = offset + consumed)
name_offset = union.name.vol.offset - union.vol.offset
name = self.parse_string(union.name, leaf_type < leaf_type.LF_ST_MAX, size = length - name_offset)
result = leaf_type, name, union