Add in LF_POINTER and rename the pdb.json file.

volatility/framework/layers/msf.py

@@ -21,7 +21,7 @@ class PdbMSF(interfaces.layers.TranslationLayerInterface):
         super().__init__(context, config_path, name, metadata)
         self._base_layer = self.config["base_layer"]
 
-        self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'pdb')
+        self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'mspdb')
         response = self._check_header()
         if response is None:
             raise ValueError("Could not find a suitable header")

volatility/framework/symbols/windows/mspdb.json

@@ -271,6 +271,67 @@
       },
       "kind": "struct",
       "size": 6
+    },
+    "LF_POINTER": {
+      "fields": {
+        "subtype_index": {
+          "offset": 0,
+          "type": {
+            "kind": "base",
+            "name": "unsigned long"
+          }
+        },
+        "constant": {
+          "offset": 4,
+          "type": {
+            "bit_length": 1,
+            "bit_position": 7,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "reference": {
+          "offset": 4,
+          "type": {
+            "bit_length": 3,
+            "bit_position": 5,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "pointer_type": {
+          "offset": 4,
+          "type": {
+            "bit_length": 5,
+            "bit_position": 0,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "size": {
+          "offset": 4,
+          "type": {
+            "bit_length": 6,
+            "bit_position": 13,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        }
+      },
+      "kind": "struct",
+      "size": 8
     }
   },
   "enums": {

volatility/framework/symbols/windows/mspdb.py

@@ -96,7 +96,11 @@ class PdbReader:
         elif LeafType in [LeafType.LF_MEMBER, LeafType.LF_MEMBER_ST]:
             pass
         elif LeafType in [LeafType.LF_MODIFIER]:
-            module.object(type_name = "LF_MODIFIER", offset = offset + LeafType.vol.base_type.size)
+            modifier = module.object(type_name = "LF_MODIFIER", offset = offset + LeafType.vol.base_type.size)
+        elif LeafType in [LeafType.LF_POINTER]:
+            pointer = module.object(type_name = "LF_POINTER", offset = offset + LeafType.vol.base_type.size)
+            import pdb
+            pdb.set_trace()
         else:
             raise ValueError("Unhandled leaf_type: {}".format(LeafType))