From afb17dfac8ef35950803e549bb127f920ae7eef0 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Wed, 24 Aug 2022 14:14:50 +0300 Subject: [PATCH] use the maximum_invalid_count --- volatility3/framework/automagic/pdbscan.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 5cbdbfe0e..0cb01485e 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -212,7 +212,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): start = start_scan_address, page_size = vlayer.page_size, pdb_names = kernel_pdb_names, - progress_callback = progress_callback) + progress_callback = progress_callback, + maximum_invalid_count = constants.windows.PE_MAX_EXTRACTION_SIZE // 0x1000) for kernel in kernels: valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: