diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility/framework/symbols/windows/pdbutil.py index 8462f4216..9f0b9e185 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility/framework/symbols/windows/pdbutil.py @@ -3,7 +3,6 @@ # import binascii -import io import json import logging import lzma @@ -17,7 +16,6 @@ from volatility.framework import constants, interfaces from volatility.framework.configuration.requirements import SymbolTableRequirement from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import pdbconv -from volatility.framework.symbols.windows.extensions import pe vollog = logging.getLogger(__name__) @@ -126,36 +124,39 @@ class PDBUtility: if mz_sig != b"MZ": return None - pe_table_name = intermed.IntermediateSymbolTable.create(context, - 'pdbutility', - "windows", - "pe", - class_types = pe.class_types) + nt_header_start = ord(layer.read(offset + 0x3C, 1)) + optional_header_size = struct.unpack('