WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 13:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

PdbUtility: Support multiple debug directories

Browse Source
This commit is contained in:
Mike Auty
2020-12-01 01:21:36 +00:00
committed by ikelos
parent 4d0a07194a
commit 8fb53a32a8
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/pdbutil.py
+8 -5
View File
@@ -148,11 +148,14 @@ class PDBUtility:
return None
# Swap the Pointer with the Address since the de-virtualization doesn't apply to the fields
debug_data = pe_data.DIRECTORY_ENTRY_DEBUG[0]
pe_data.set_dword_at_offset(debug_data.struct.get_field_absolute_offset('AddressOfRawData'),
debug_data.struct.PointerToRawData)
pe_data.full_load()
debug_entry = pe_data.DIRECTORY_ENTRY_DEBUG[0].entry
debug_entry = None
for index in range(len(pe_data.DIRECTORY_ENTRY_DEBUG)):
if pe_data.DIRECTORY_ENTRY_DEBUG[index].struct.Type == 2:
debug_data = pe_data.DIRECTORY_ENTRY_DEBUG[index]
pe_data.set_dword_at_offset(debug_data.struct.get_field_absolute_offset('AddressOfRawData'),
debug_data.struct.PointerToRawData)
pe_data.full_load()
debug_entry = pe_data.DIRECTORY_ENTRY_DEBUG[index].entry
if debug_entry is None:
return None