From 28fdbbe3486738ff0b9cdf76ee2c1c5bd31622e4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 3 Nov 2016 00:53:08 +0000 Subject: [PATCH] Refactor the pdb names, to make the class more generic. --- volatility/framework/automagic/pdbscan.py | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 6f8678292..e8cec09da 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -16,15 +16,12 @@ PAGE_SIZE = 0x1000 class PdbSigantureScanner(interfaces.layers.ScannerInterface): overlap = 0x4000 - _kernel_pdbs = [ - b"ntkrnlmp.pdb", - b"ntkrnlpa.pdb", - b"ntkrpamp.pdb", - b"ntoskrnl.pdb", - ] - _RSDS_format = struct.Struct("<16BI") + def __init__(self, pdb_names): + super().__init__() + self._pdb_names = pdb_names + def __call__(self, data, data_offset): sig = data.find(b"RSDS") pdb_hits = [] @@ -34,7 +31,7 @@ class PdbSigantureScanner(interfaces.layers.ScannerInterface): if (null - sig - self._RSDS_format.size) <= 100: name_offset = sig + 4 + self._RSDS_format.size pdb_name = data[name_offset:null] - if pdb_name in self._kernel_pdbs: + if pdb_name in self._pdb_names: ## thie ordering is intentional due to mixed endianness in the GUID (g3, g2, g1, g0, g5, g4, g7, g6, g8, g9, ga, gb, gc, gd, ge, gf, a) = \ @@ -57,7 +54,14 @@ def scan(ctx, layer_name): """ results = [] min_pfn = 0 - for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner()): + pdb_names = [ + b"ntkrnlmp.pdb", + b"ntkrnlpa.pdb", + b"ntkrpamp.pdb", + b"ntoskrnl.pdb", + ] + + for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names)): mz_offset = None sig_pfn = signature_offset // PAGE_SIZE