WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make sure we get the full name, and get our omap bisection right.

Browse Source
This commit is contained in:
Mike Auty
2019-07-30 22:14:19 +01:00
committed by ikelos
parent a72314a2b2
commit ca7e09de04
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/mspdb.py
+5 -5
View File
@@ -382,9 +382,9 @@ class PdbReader:
def omap_lookup(self, address):
"""Looks up an address using the omap mapping"""
pos = bisect(self.omap_mapping, (address, 0))
if self.omap_mapping[pos][0] != address:
pos = pos - 1
pos = bisect(self.omap_mapping, (address, -1))
if self.omap_mapping[pos + 1][0] == address:
pos += 1
if not self.omap_mapping[pos][1]:
return 0
@@ -453,11 +453,11 @@ class PdbReader:
name = None
if leaf_type == 0x110e:
# v3 symbol (c-string)
name = self.parse_string(sym.name, False, sym.length - sym.vol.size - 4)
name = self.parse_string(sym.name, False, sym.length - sym.vol.size + 4)
address = self.sections[sym.segment - 1].VirtualAddress + sym.offset
elif leaf_type == 0x1009:
# v2 symbol (pascal-string)
name = self.parse_string(sym.name, True, sym.length - sym.vol.size - 4)
name = self.parse_string(sym.name, True, sym.length - sym.vol.size + 4)
address = self.sections[sym.segment - 1].VirtualAddress + sym.offset
else:
vollog.warning("Only v2 and v3 symbols are supported")