WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

improv commit

Browse Source
This commit is contained in:
Paul Kermann
2022-08-15 15:27:19 +03:00
parent f8506862c4
commit 99672cbe75
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/pdbutil.py
+8 -2
View File
@@ -253,7 +253,8 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
pdb_names: List[bytes],
progress_callback: constants.ProgressCallback = None,
start: Optional[int] = None,
end: Optional[int] = None) -> Generator[Dict[str, Optional[Union[bytes, str, int]]], None, None]:
end: Optional[int] = None,
maximum_invalid_count: int = 100) -> Generator[Dict[str, Optional[Union[bytes, str, int]]], None, None]:
"""Scans through `layer_name` at `ctx` looking for RSDS headers that
indicate one of four common pdb kernel names (as listed in
`self.pdb_names`) and returns the tuple (GUID, age, pdb_name,
@@ -278,10 +279,15 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
sections = [(start, end - start)]):
mz_offset = None
sig_pfn = signature_offset // page_size
current_invalid_counter = 0
for i in range(sig_pfn, min_pfn, -1):
if not ctx.layers[layer_name].is_valid(i * page_size, 2):
if current_invalid_counter > maximum_invalid_count:
break
if not ctx.layers[layer_name].is_valid(i * page_size, 2):
current_invalid_counter += 1
continue
data = ctx.layers[layer_name].read(i * page_size, 2)
if data == b'MZ':