From c2b290dc42dac2c02e820d01fc3a90f22661e657 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 12 Jul 2021 10:48:43 +0100 Subject: [PATCH] Windows: Fix up pdb.json for LF_UDT_SRC_LINE It looks like some copypasta snuck in the manual pdb.json. The offsets for the LF_UDT_SRC_LINE as was the total structure size for LF_UDT_MOD_SRC_LINE. Fixes #527 --- volatility3/framework/symbols/windows/pdb.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdb.json b/volatility3/framework/symbols/windows/pdb.json index 42c11ec26..049680326 100644 --- a/volatility3/framework/symbols/windows/pdb.json +++ b/volatility3/framework/symbols/windows/pdb.json @@ -1305,14 +1305,14 @@ } }, "source_file": { - "offset": 0, + "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "line": { - "offset": 0, + "offset": 8, "type": { "kind": "base", "name": "unsigned long" @@ -1354,7 +1354,7 @@ } }, "kind": "struct", - "size": 12 + "size": 16 }, "LF_UNION": { "fields": {