mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-13 13:17:38 +02:00
Add version to pdb signature scanner and require it for the banners plugin
This commit is contained in:
@@ -30,6 +30,11 @@ class Banners(interfaces.plugins.PluginInterface):
|
||||
component=scanners.RegExScanner,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
requirements.VersionRequirement(
|
||||
name="pdb_signature_scanner",
|
||||
component=pdbutil.PdbSignatureScanner,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
]
|
||||
|
||||
def _generator(self):
|
||||
|
||||
@@ -525,6 +525,10 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface):
|
||||
.. note:: The pdb_names must be a list of byte strings, unicode strs will not match against the data scanned
|
||||
"""
|
||||
|
||||
_version = (1, 0, 0)
|
||||
|
||||
_required_framework_version = (2, 27, 0)
|
||||
|
||||
overlap = 0x4000
|
||||
"""The size of overlap needed for the signature to ensure data cannot hide between two scanned chunks"""
|
||||
thread_safe = True
|
||||
@@ -548,9 +552,7 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface):
|
||||
)
|
||||
for match in re.finditer(pattern, data, flags=re.DOTALL):
|
||||
pdb_name = data[
|
||||
match.start(0)
|
||||
+ 4
|
||||
+ self._RSDS_format.size : match.start(0)
|
||||
match.start(0) + 4 + self._RSDS_format.size : match.start(0)
|
||||
+ len(match.group())
|
||||
- 1
|
||||
]
|
||||
|
||||
Reference in New Issue
Block a user