WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

PdbUtility: Fixes from npetroni (and restore progress)

Browse Source
This commit is contained in:
Mike Auty
2020-09-01 09:02:13 +01:00
committed by ikelos
parent b9e0670e90
commit 88214527ab
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/pdbscan.py
+2 -1
View File
@@ -109,7 +109,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
age = kernel['age'],
pdb_name = kernel['pdb_name'],
symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols",
config_path = sub_config_path)
config_path = sub_config_path,
progress_callback = progress_callback)
else:
vollog.debug("No suitable kernel pdb signature found")
volatility/framework/symbols/windows/pdb.py
+7 -4
View File
@@ -30,7 +30,7 @@ class PDBUtility:
offset: int,
symbol_table_class: str,
config_path: str = None,
progress_callback: constants.ProgressCallback = None) -> str:
progress_callback: constants.ProgressCallback = None) -> Optional[str]:
"""Produces the name of a symbol table loaded from the offset for an MZ header
Args:
@@ -44,9 +44,12 @@ class PDBUtility:
Returns:
None if no pdb information can be determined, else returned the name of the loaded symbols for the MZ
"""
guid, age, pdb_name = cls.get_guid_from_mz(context, layer_name, offset)
result = cls.get_guid_from_mz(context, layer_name, offset)
if result is None:
return None
guid, age, pdb_name = result
if config_path is None:
config_path = interfaces.configuration.path_join('pdbutility', pdb_name.strip('\x00').replace('.', '_'))
config_path = interfaces.configuration.path_join('pdbutility', pdb_name.replace('.', '_'))
return cls.load_windows_symbol_table(context, guid, age, pdb_name, symbol_table_class, config_path,
progress_callback)
@@ -136,7 +139,7 @@ class PDBUtility:
# Extract the data
debug_entry = pe_data.DIRECTORY_ENTRY_DEBUG[0].entry
pdb_name = debug_entry.PdbFileName.decode("utf-8")
pdb_name = debug_entry.PdbFileName.decode("utf-8").strip('\x00')
age = debug_entry.Age
guid = "{:x}{:x}{:x}{}".format(debug_entry.Signature_Data1, debug_entry.Signature_Data2,
debug_entry.Signature_Data3,