WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #643 from ilay122/bugfix/mz_parsing

Browse Source 
fix pdb mz parsing
This commit is contained in:
ikelos
2022-02-09 19:46:09 +00:00
committed by GitHub
parent dbf6245b85 ce166b9263
commit 3e742bf1f7
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/pdbutil.py
+8 -2
View File
@@ -131,8 +131,14 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
# Check it is actually the MZ header
if mz_sig != b"MZ":
return None
nt_header_start = ord(layer.read(offset + 0x3C, 1))
nt_header_start = struct.unpack("<I", layer.read(offset + 0x3C, 4))[0]
pe_sig = layer.read(offset + nt_header_start, 2)
# Check it is actually the Nt Headers
if pe_sig != b"PE":
return None
optional_header_size = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))[0]
# Just enough to tell us the max size
pe_header = layer.read(offset, nt_header_start + 0x16 + optional_header_size)