WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in base-type generation for pdbconv.py.

Browse Source
This commit is contained in:
Mike Auty
2019-04-23 22:28:29 +01:00
parent 93ddb9596b
commit 60144c44d3
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
development/pdbconv.py
+18 -14
View File
@@ -13,11 +13,12 @@ import requests
logger = logging.getLogger(__name__)
logger.setLevel(1)
console = logging.StreamHandler()
console.setLevel(1)
formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s')
console.setFormatter(formatter)
logger.addHandler(console)
if __name__ == '__main__':
console = logging.StreamHandler()
console.setLevel(1)
formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s')
console.setFormatter(formatter)
logger.addHandler(console)
class PDBRetreiver:
@@ -321,14 +322,13 @@ class PDBConvertor:
"""Reads the user types from the PDB file"""
logger.info("Reading usertypes...")
output = {}
for stream in self._pdb.streams:
if isinstance(stream, pdbparse.PDBTypeStream):
for type_index in stream.types:
user_type = stream.types[type_index]
if (user_type.leaf_type == "LF_STRUCTURE" and not user_type.prop.fwdref):
output.update(self._format_usertype(user_type, "struct"))
elif (user_type.leaf_type == "LF_UNION" and not user_type.prop.fwdref):
output.update(self._format_usertype(user_type, "union"))
stream = self._pdb.STREAM_TPI
for type_index in stream.types:
user_type = stream.types[type_index]
if (user_type.leaf_type == "LF_STRUCTURE" and not user_type.prop.fwdref):
output.update(self._format_usertype(user_type, "struct"))
elif (user_type.leaf_type == "LF_UNION" and not user_type.prop.fwdref):
output.update(self._format_usertype(user_type, "union"))
return output
def _format_usertype(self, usertype, kind) -> Dict:
@@ -404,7 +404,11 @@ class PDBConvertor:
def read_basetypes(self) -> Dict:
"""Reads the base types from the PDB file"""
output = {}
ptr_size = 4
if "64" in self._pdb.STREAM_DBI.machine:
ptr_size = 8
output = {"pointer": {"endian": "little", "kind": "int", "signed": False, "size": ptr_size}}
for index in self._seen_ctypes:
output[self.ctype[index]] = {
"endian": "little",