WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Allow start/end positions on the pdb scanning.

Browse Source
This commit is contained in:
Mike Auty
2016-12-21 02:28:03 +00:00
parent 591d9eba27
commit 9ca001df8b
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/pdbscan.py
+4 -3
View File
@@ -31,7 +31,6 @@ class PdbSigantureScanner(interfaces.layers.ScannerInterface):
def __call__(self, data, data_offset):
sig = data.find(b"RSDS")
pdb_hits = []
while sig >= 0:
null = data.find(b'\0', sig + 4 + self._RSDS_format.size)
if null > -1:
@@ -49,7 +48,7 @@ class PdbSigantureScanner(interfaces.layers.ScannerInterface):
sig = data.find(b"RSDS", sig + 1)
def scan(ctx, layer_name):
def scan(ctx, layer_name, start = None, end = None):
"""Scans through layer_name at context and returns the tuple
(GUID, age, pdb_name, signature_offset, mz_offset)
@@ -69,7 +68,9 @@ def scan(ctx, layer_name):
]
for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names),
progress_callback = progress_callback):
progress_callback = progress_callback,
min_address = start,
max_address = end):
mz_offset = None
sig_pfn = signature_offset // PAGE_SIZE