diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 714f849bc..7b5b1ebd2 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -358,6 +358,8 @@ class Version1Format(ISFormatTable): update['count'] = dictionary['count'] update['subtype'] = self._interdict_to_template(dictionary['subtype']) elif type_name == 'pointer': + if dictionary.get('name', None): + native_template = self.natives.get_type(self.name + constants.BANG + dictionary['name']) update['subtype'] = self._interdict_to_template(dictionary['subtype']) elif type_name == 'enum': update = self._lookup_enum(dictionary['name']) @@ -572,3 +574,11 @@ class Version6Format(Version5Format): if self._json_object.get('metadata', {}).get('linux'): return metadata.LinuxMetadata(self._json_object['metadata']['linux']) return None + + +class Version7Format(Version6Format): + """Class for storing intermediate debugging data as objects and classes""" + current = 7 + revision = 0 + age = 1 + version = (current - age, age, revision) diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index 805608029..27ed158df 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -236,7 +236,7 @@ indirections = { "signed": False, "size": 4 }), - 0x600: ("pointer", { + 0x600: ("pointer64", { "endian": "little", "kind": "int", "signed": False, @@ -291,7 +291,7 @@ class PdbReader: self.symbols = {} # type: Dict[str, Any] self._omap_mapping = [] # type: List[Tuple[int, int]] self._sections = [] # type: List[interfaces.objects.ObjectInterface] - self.metadata = {"format": "6.0.0", "windows": {}} + self.metadata = {"format": "6.1.0", "windows": {}} @property def context(self): @@ -579,7 +579,7 @@ class PdbReader: if indirection: pointer_name, pointer_base = indirections[indirection] self.bases[pointer_name] = pointer_base - result = {"kind": pointer_name, "subtype": result} + result = {"kind": "pointer", "name": pointer_name, "subtype": result} return result else: leaf_type, name, value = self.types[index - 0x1000] @@ -600,6 +600,13 @@ class PdbReader: "bit_position": value.position } elif leaf_type in [leaf_type.LF_POINTER]: + # Since we use the base['pointer'] to set the size for pointers, update it and check we don't get conflicts + size = self.get_size_from_index(index) + if self.bases.get("pointer", None) is None: + self.bases['pointer'] = {"endian": "little", "kind": "int", "signed": False, "size": size} + else: + if size != self.bases['pointer']['size']: + raise ValueError("Native pointers with different sizes!") result = {"kind": "pointer", "subtype": self.get_type_from_index(value.subtype_index)} elif leaf_type in [leaf_type.LF_PROCEDURE]: return {"kind": "function"}