From 6b4e80f1e5ab9446ffd7a6c600a59f4c68016f80 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 14 Dec 2016 01:54:50 +0000 Subject: [PATCH] Take a tiny bit longer, but properly check all the kernels in case a match is hiding later in the list. --- volatility/framework/automagic/pdbscan.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 555651b2f..8e17d2b18 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -236,9 +236,11 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): address = context.object("unsigned long long", offset = result - 6 - 8, layer_name = physical_layer_name) try: - if kernels[0]['mz_offset'] in [mapping[1] for mapping in vlayer.mapping(address, 0)]: - valid_kernels[virtual_layer_name] = (address, kernels[0]) - break + for kernel in kernels: + for mapping in vlayer.mapping(address, 0): + if kernel['mz_offset'] == mapping[1]: + valid_kernels[virtual_layer_name] = (address, kernel) + break except exceptions.PagedInvalidAddressException: # We don't care if we're mapping an address to 0, it's not what we're looking for pass