From 65310eb84195b5a063b3a60e8767ffdb3dae9f21 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 29 Nov 2020 23:05:21 +0000 Subject: [PATCH] Pdbconv: Slight tweaks to database_name finding --- volatility/framework/symbols/windows/pdbconv.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility/framework/symbols/windows/pdbconv.py index 3ef386c67..f0f9fd10d 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility/framework/symbols/windows/pdbconv.py @@ -353,7 +353,8 @@ class PdbReader: type_references = self._read_info_stream(4, "IPI", ipi_list) for name in type_references.keys(): - if '.pdb' in name: + # This doesn't break, because we want to use the last string/pdbname in the list + if name.endswith('.pdb'): self._database_name = name.split('\\')[-1] def _read_info_stream(self, stream_number, stream_name, info_list):