From 8fb53a32a82b9c587b86a32215f52cc092469384 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Dec 2020 01:20:28 +0000 Subject: [PATCH] PdbUtility: Support multiple debug directories --- volatility/framework/symbols/windows/pdbutil.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility/framework/symbols/windows/pdbutil.py index 9f0b9e185..5cabc951f 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility/framework/symbols/windows/pdbutil.py @@ -148,11 +148,14 @@ class PDBUtility: return None # Swap the Pointer with the Address since the de-virtualization doesn't apply to the fields - debug_data = pe_data.DIRECTORY_ENTRY_DEBUG[0] - pe_data.set_dword_at_offset(debug_data.struct.get_field_absolute_offset('AddressOfRawData'), - debug_data.struct.PointerToRawData) - pe_data.full_load() - debug_entry = pe_data.DIRECTORY_ENTRY_DEBUG[0].entry + debug_entry = None + for index in range(len(pe_data.DIRECTORY_ENTRY_DEBUG)): + if pe_data.DIRECTORY_ENTRY_DEBUG[index].struct.Type == 2: + debug_data = pe_data.DIRECTORY_ENTRY_DEBUG[index] + pe_data.set_dword_at_offset(debug_data.struct.get_field_absolute_offset('AddressOfRawData'), + debug_data.struct.PointerToRawData) + pe_data.full_load() + debug_entry = pe_data.DIRECTORY_ENTRY_DEBUG[index].entry if debug_entry is None: return None