From aee05f61f6f3aae8593e4001a0443cc5fcd90296 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 9 Jul 2019 21:14:31 +0100 Subject: [PATCH] Add in linkage name code. --- volatility/framework/symbols/windows/mspdb.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index 12d999993..9d429d3be 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -479,7 +479,10 @@ class PdbReader: if name: if self._omap_mapping: address = self.omap_lookup(address) - self.symbols[self.name_strip(name)] = {"address": address} + stripped_name = self.name_strip(name) + self.symbols[stripped_name] = {"address": address} + if name != self.name_strip(name): + self.symbols[stripped_name]["linkage_name"] = name offset += sym.length + 2 # Add on length itself def read_pdb_info_stream(self):