diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index 85a6f4862..2b354edcb 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -30,6 +30,11 @@ class Banners(interfaces.plugins.PluginInterface): component=scanners.RegExScanner, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="pdb_signature_scanner", + component=pdbutil.PdbSignatureScanner, + version=(1, 0, 0), + ), ] def _generator(self): diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 5f5c8cac8..d1ea4abd5 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -525,6 +525,10 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface): .. note:: The pdb_names must be a list of byte strings, unicode strs will not match against the data scanned """ + _version = (1, 0, 0) + + _required_framework_version = (2, 27, 0) + overlap = 0x4000 """The size of overlap needed for the signature to ensure data cannot hide between two scanned chunks""" thread_safe = True @@ -548,9 +552,7 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface): ) for match in re.finditer(pattern, data, flags=re.DOTALL): pdb_name = data[ - match.start(0) - + 4 - + self._RSDS_format.size : match.start(0) + match.start(0) + 4 + self._RSDS_format.size : match.start(0) + len(match.group()) - 1 ]