update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"

2026-09-27 03:54:49 +02:00 · 2018-06-12 08:41:37 +01:00
parent 7ae0d654c2
commit 76f5d35499
1 changed files with 3 additions and 5 deletions
@@ -7,12 +7,10 @@ class _KDDEBUGGER_DATA64(objects.Struct):
        """Returns the NT build lab string from the KDBG"""

        layer_name = self.vol.layer_name
-        nt_symbol_name = self.get_symbol_table().table_mapping["nt_symbols"]
+        symbol_table_name = self.get_symbol_table().name

-        kvo = self._context.memory[layer_name].config['kernel_virtual_offset']
-        ntkrnlmp = self._context.module(nt_symbol_name, layer_name=layer_name, offset=kvo)
-
-        return ntkrnlmp.object(type_name="string",
+        return self._context.object(symbol_table_name + constants.BANG + "string",
+                               layer_name=layer_name,
                               offset=self.NtBuildLab,
                               max_length=32,
                               errors="replace")