WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 21:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve PDB parsing to include symbol undecoration.

Browse Source
This commit is contained in:
Mike Auty
2019-04-27 21:05:55 +01:00
parent 61f9173bb6
commit 470d3906dc
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
development/pdbconv.py
+6 -2
View File
@@ -8,6 +8,7 @@ import tempfile
from typing import Dict
import pdbparse
import pdbparse.undecorate
import requests
logger = logging.getLogger(__name__)
@@ -217,6 +218,8 @@ class PDBConvertor:
"T_64PLONG": 8,
"PTR_64": 8,
"PTR_32": 4,
"PTR_NEAR32": 4,
"PTR_NEAR64": 8,
}
def __init__(self, filename):
@@ -311,10 +314,11 @@ class PDBConvertor:
virt_base = sects[sym.segment - 1].VirtualAddress
except IndexError:
continue
name, _, _ = pdbparse.undecorate.undecorate(sym.name)
if omap:
output[sym.name] = {"address": omap.remap(sym.offset + virt_base)}
output[name] = {"address": omap.remap(sym.offset + virt_base)}
else:
output[sym.name] = {"address": sym.offset + virt_base}
output[name] = {"address": sym.offset + virt_base}
return output