From 9ca001df8ba7ca059fba538a6605abdfa9af82de Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 21 Dec 2016 02:28:03 +0000 Subject: [PATCH] Allow start/end positions on the pdb scanning. --- volatility/framework/automagic/pdbscan.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index d78a01a0e..0662e786e 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -31,7 +31,6 @@ class PdbSigantureScanner(interfaces.layers.ScannerInterface): def __call__(self, data, data_offset): sig = data.find(b"RSDS") - pdb_hits = [] while sig >= 0: null = data.find(b'\0', sig + 4 + self._RSDS_format.size) if null > -1: @@ -49,7 +48,7 @@ class PdbSigantureScanner(interfaces.layers.ScannerInterface): sig = data.find(b"RSDS", sig + 1) -def scan(ctx, layer_name): +def scan(ctx, layer_name, start = None, end = None): """Scans through layer_name at context and returns the tuple (GUID, age, pdb_name, signature_offset, mz_offset) @@ -69,7 +68,9 @@ def scan(ctx, layer_name): ] for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names), - progress_callback = progress_callback): + progress_callback = progress_callback, + min_address = start, + max_address = end): mz_offset = None sig_pfn = signature_offset // PAGE_SIZE