From 36c84635f904057a517dea7a2d9c95eeca4371b7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 7 Jul 2019 16:01:43 +0100 Subject: [PATCH] Fix up size of indirect primatives. --- volatility/framework/symbols/windows/mspdb.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index 4ee35fb10..d7c9a14b3 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -412,7 +412,10 @@ class PdbReader: def get_size_from_index(self, index: int) -> int: if index < 0x1000: - _, base = primatives[index & 0xff] + if (index & 0xf00): + _, base = indirections[index & 0xf00] + else: + _, base = primatives[index & 0xff] return base['size'] else: leaf_type, name, value = self.types[index - 0x1000] @@ -524,7 +527,6 @@ class PdbReader: def convert_fields(self, fields: int): result = {} - print(fields) _, _, fields_struct = self.types[fields] for field in fields_struct: _, name, member = field