diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index b1d125076..6f938fee4 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -721,14 +721,12 @@ class PdbReader: leaf_type = self.context.object( module.get_enumeration("LEAF_TYPE"), layer_name = module._layer_name, offset = offset) consumed = leaf_type.vol.base_type.size - offset += consumed - length -= consumed if leaf_type in [ leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST, leaf_type.LF_INTERFACE ]: - structure = module.object(type_name = "LF_STRUCTURE", offset = offset) + structure = module.object(type_name = "LF_STRUCTURE", offset = offset + consumed) name_offset = structure.name.vol.offset - structure.vol.offset name, value, excess = self.determine_extended_value(leaf_type, structure.size, module, length - name_offset) structure.size = value @@ -736,7 +734,7 @@ class PdbReader: consumed = length result = leaf_type, name, structure elif leaf_type in [leaf_type.LF_MEMBER, leaf_type.LF_MEMBER_ST]: - member = module.object(type_name = "LF_MEMBER", offset = offset) + member = module.object(type_name = "LF_MEMBER", offset = offset + consumed) name_offset = member.name.vol.offset - member.vol.offset name, value, excess = self.determine_extended_value(leaf_type, member.offset, module, length - name_offset) member.offset = value @@ -744,12 +742,12 @@ class PdbReader: result = leaf_type, name, member consumed += member.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_POINTER, leaf_type.LF_PROCEDURE]: - obj = module.object(type_name = leaf_type.lookup(), offset = offset) + obj = module.object(type_name = leaf_type.lookup(), offset = offset + consumed) result = leaf_type, None, obj consumed = length elif leaf_type in [leaf_type.LF_FIELDLIST]: - sub_length = length - sub_offset = offset + sub_length = length - consumed + sub_offset = offset + consumed fields = [] while length > consumed: subfield, sub_consumed = self.consume_type(module, sub_offset, sub_length) @@ -760,11 +758,11 @@ class PdbReader: fields.append(subfield) result = leaf_type, None, fields elif leaf_type in [leaf_type.LF_BITFIELD]: - bitfield = module.object(type_name = "LF_BITFIELD", offset = offset) + bitfield = module.object(type_name = "LF_BITFIELD", offset = offset + consumed) result = leaf_type, None, bitfield consumed = length elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]: - array = module.object(type_name = "LF_ARRAY", offset = offset) + array = module.object(type_name = "LF_ARRAY", offset = offset + consumed) name_offset = array.name.vol.offset - array.vol.offset name, value, excess = self.determine_extended_value(leaf_type, array.size, module, length - name_offset) array.size = value @@ -772,14 +770,14 @@ class PdbReader: result = leaf_type, name, array consumed = length elif leaf_type in [leaf_type.LF_ARGLIST, leaf_type.LF_ENUM]: - enum = module.object(type_name = "LF_ENUM", offset = offset) + enum = module.object(type_name = "LF_ENUM", offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name = self.parse_string(enum.name, leaf_type < leaf_type.LF_ST_MAX, size = length - name_offset) enum.name = name # type: Union[str, interfaces.objects.ObjectInterface] result = leaf_type, name, enum consumed = length elif leaf_type in [leaf_type.LF_ENUMERATE]: - enum = module.object(type_name = 'LF_ENUMERATE', offset = offset) + enum = module.object(type_name = 'LF_ENUMERATE', offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name, value, excess = self.determine_extended_value(leaf_type, enum.value, module, length - name_offset) enum.value = value @@ -787,7 +785,7 @@ class PdbReader: result = leaf_type, name, enum consumed += enum.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_UNION]: - union = module.object(type_name = "LF_UNION", offset = offset) + union = module.object(type_name = "LF_UNION", offset = offset + consumed) name_offset = union.name.vol.offset - union.vol.offset name = self.parse_string(union.name, leaf_type < leaf_type.LF_ST_MAX, size = length - name_offset) result = leaf_type, name, union