diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index d1ea4abd5..af86f6997 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -552,7 +552,9 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface): ) for match in re.finditer(pattern, data, flags=re.DOTALL): pdb_name = data[ - match.start(0) + 4 + self._RSDS_format.size : match.start(0) + match.start(0) + + 4 + + self._RSDS_format.size : match.start(0) + len(match.group()) - 1 ]