From 9bb0745b83b63eb3da39f76cbe84e8ebe8f1a383 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 8 Dec 2016 16:29:36 +0000 Subject: [PATCH] Clean up the debug messages for pdbscanning. --- volatility/framework/automagic/pdbscan.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index e974ff3eb..9aebf4d48 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -159,6 +159,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): context.config[interfaces.configuration.path_join(sub_config_path, "idd_filepath")] = idd_path # Construct the appropriate symbol table requirement.construct(context, config_path) + break else: vollog.debug("Symbol library path not found: {}".format(midfix + suffix)) else: @@ -212,6 +213,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): except exceptions.PagedInvalidAddressException: vollog.debug("Potential kernel_virtual_offset caused a page fault: {}".format(hex(kvo))) else: + vollog.debug("Kernel base randomized, searching for base address offset") # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization if kernels: physical_layer = context.memory[physical_layer_name]