From c97b05426a9c2e400cdb550cb89598fddb9385a3 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 1 Jul 2019 02:11:21 +0100
Subject: [PATCH] Add in LF_POINTER and rename the pdb.json file.

---
 volatility/framework/layers/msf.py            |  2 +-
 .../symbols/windows/{pdb.json => mspdb.json}  | 61 +++++++++++++++++++
 volatility/framework/symbols/windows/mspdb.py |  6 +-
 3 files changed, 67 insertions(+), 2 deletions(-)
 rename volatility/framework/symbols/windows/{pdb.json => mspdb.json} (89%)

diff --git a/volatility/framework/layers/msf.py b/volatility/framework/layers/msf.py
index 216159b9b..80cb06ef5 100644
--- a/volatility/framework/layers/msf.py
+++ b/volatility/framework/layers/msf.py
@@ -21,7 +21,7 @@ class PdbMSF(interfaces.layers.TranslationLayerInterface):
         super().__init__(context, config_path, name, metadata)
         self._base_layer = self.config["base_layer"]
 
-        self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'pdb')
+        self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'mspdb')
         response = self._check_header()
         if response is None:
             raise ValueError("Could not find a suitable header")
diff --git a/volatility/framework/symbols/windows/pdb.json b/volatility/framework/symbols/windows/mspdb.json
similarity index 89%
rename from volatility/framework/symbols/windows/pdb.json
rename to volatility/framework/symbols/windows/mspdb.json
index 28a81fa33..ad1e85d41 100644
--- a/volatility/framework/symbols/windows/pdb.json
+++ b/volatility/framework/symbols/windows/mspdb.json
@@ -271,6 +271,67 @@
       },
       "kind": "struct",
       "size": 6
+    },
+    "LF_POINTER": {
+      "fields": {
+        "subtype_index": {
+          "offset": 0,
+          "type": {
+            "kind": "base",
+            "name": "unsigned long"
+          }
+        },
+        "constant": {
+          "offset": 4,
+          "type": {
+            "bit_length": 1,
+            "bit_position": 7,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "reference": {
+          "offset": 4,
+          "type": {
+            "bit_length": 3,
+            "bit_position": 5,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "pointer_type": {
+          "offset": 4,
+          "type": {
+            "bit_length": 5,
+            "bit_position": 0,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        },
+        "size": {
+          "offset": 4,
+          "type": {
+            "bit_length": 6,
+            "bit_position": 13,
+            "kind": "bitfield",
+            "type": {
+              "kind": "base",
+              "name": "unsigned long"
+            }
+          }
+        }
+      },
+      "kind": "struct",
+      "size": 8
     }
   },
   "enums": {
diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py
index 8374beacc..af96ea3b4 100644
--- a/volatility/framework/symbols/windows/mspdb.py
+++ b/volatility/framework/symbols/windows/mspdb.py
@@ -96,7 +96,11 @@ class PdbReader:
         elif LeafType in [LeafType.LF_MEMBER, LeafType.LF_MEMBER_ST]:
             pass
         elif LeafType in [LeafType.LF_MODIFIER]:
-            module.object(type_name = "LF_MODIFIER", offset = offset + LeafType.vol.base_type.size)
+            modifier = module.object(type_name = "LF_MODIFIER", offset = offset + LeafType.vol.base_type.size)
+        elif LeafType in [LeafType.LF_POINTER]:
+            pointer = module.object(type_name = "LF_POINTER", offset = offset + LeafType.vol.base_type.size)
+            import pdb
+            pdb.set_trace()
         else:
             raise ValueError("Unhandled leaf_type: {}".format(LeafType))