From 767eea614b968406faba25e02bf6d3c192ee6843 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 19 Jul 2021 12:31:13 +0100 Subject: [PATCH] Windows: Add extra checks to pdbscan --- volatility3/framework/automagic/pdbscan.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index b32010506..474146ad1 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -138,6 +138,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]: def test_virtual_kernel(physical_layer_name, virtual_layer_name, kernel): + # It seems the kernel is loaded at a fixed mapping (presumably because the memory manager hasn't started yet) + if kernel['mz_offset'] is None or not isinstance(kernel['mz_offset'], int): + # Rule out kernels that couldn't find a suitable MZ header + return None return (virtual_layer_name, kernel['mz_offset'], kernel) vollog.debug("Kernel base determination - slow scan virtual layer")