Merge remote-tracking branch 'origin/master' into local/swap-support

This commit is contained in:
Mike Auty
2018-02-07 20:16:38 +00:00
2 changed files with 11 additions and 2 deletions
+6
View File
@@ -14,3 +14,9 @@ workspace.xml
.mypy_cache
stubs
volatility/symbols/windows/*.pdb
# Mac metadata files
.DS_Store
# Volatility's config
config*.json
+5 -2
View File
@@ -12,7 +12,7 @@ import typing
from volatility.framework import exceptions, layers, validity
from volatility.framework.layers import scanners
from volatility.framework.symbols import native, intermed
from volatility.framework.symbols import intermed, native
if __name__ == "__main__":
import sys
@@ -197,7 +197,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
_kvo, kernel = self.valid_kernels[virtual_layer]
filter = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age']))
# Take the first result of search for the intermediate file
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__()
try:
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__()
except StopIteration:
isf_path = None
if isf_path:
vollog.debug("Using symbol library: {}".format(filter))
clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols"