From b43712f9f482c9b66ff26372b7ac134a61b9852c Mon Sep 17 00:00:00 2001 From: shusei tomonaga <8147599+shu-tom@users.noreply.github.com> Date: Mon, 30 Aug 2021 21:24:47 +0900 Subject: [PATCH] Fixed an issue where the PDB guid value was not zero padded. --- volatility3/framework/symbols/windows/pdbutil.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 9f2cc1462..9d8b2431b 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -170,9 +170,9 @@ class PDBUtility(interfaces.configuration.VersionableInterface): pdb_name = debug_entry.PdbFileName.decode("utf-8").strip('\x00') age = debug_entry.Age - guid = "{:x}{:x}{:x}{}".format(debug_entry.Signature_Data1, debug_entry.Signature_Data2, - debug_entry.Signature_Data3, - binascii.hexlify(debug_entry.Signature_Data4).decode('utf-8')) + guid = "{:08x}{:04x}{:04x}{}".format(debug_entry.Signature_Data1, debug_entry.Signature_Data2, + debug_entry.Signature_Data3, + binascii.hexlify(debug_entry.Signature_Data4).decode('utf-8')) return guid, age, pdb_name @classmethod