From 927bcd33181df62f889def1ab92cbb72add1ede2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 10 Jul 2019 21:31:54 +0100 Subject: [PATCH] Only use different pointers when necessary. --- volatility/framework/symbols/windows/mspdb.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index 27ed158df..00f995a09 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -578,8 +578,11 @@ class PdbReader: indirection = (index & 0xf00) if indirection: pointer_name, pointer_base = indirections[indirection] - self.bases[pointer_name] = pointer_base - result = {"kind": "pointer", "name": pointer_name, "subtype": result} + if self.bases.get('pointer', None) and self.bases['pointer'] == pointer_base: + result = {"kind": "pointer", "subtype": result} + else: + self.bases[pointer_name] = pointer_base + result = {"kind": "pointer", "name": pointer_name, "subtype": result} return result else: leaf_type, name, value = self.types[index - 0x1000]