diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index d65fde3ea..3556adace 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -13,6 +13,10 @@ class PdbReader: def __init__(self, context: interfaces.context.ContextInterface, location: str): self._layer_name, self._context = self.load_pdb_layer(context, location) + @property + def context(self): + return self._context + @property def pdb_layer_name(self): return self._layer_name @@ -81,18 +85,18 @@ class PdbReader: return header def process_type(self, module: interfaces.context.ModuleInterface, offset: int) -> Dict[str, Dict]: - leaf_type = module.object(type_name = "unsigned short", offset = offset) - LeafType = module.get_enumeration("LEAF_TYPE") + LeafType = self.context.object( + module.get_enumeration("LEAF_TYPE"), layer_name = module._layer_name, offset = offset) - if leaf_type in [ + if LeafType in [ LeafType.LF_CLASS, LeafType.LF_CLASS_ST, LeafType.LF_STRUCTURE, LeafType.LF_STRUCTURE_ST, LeafType.LF_INTERFACE ]: pass - elif leaf_type in [LeafType.LF_MEMBER, LeafType.LF_MEMBER_ST]: + elif LeafType in [LeafType.LF_MEMBER, LeafType.LF_MEMBER_ST]: pass else: - raise ValueError("Unhandled leaf_type: {}".format(leaf_type)) + raise ValueError("Unhandled leaf_type: {}".format(LeafType)) return {} diff --git a/volatility/framework/symbols/windows/pdb.json b/volatility/framework/symbols/windows/pdb.json index 2a98326bf..75938dd1c 100644 --- a/volatility/framework/symbols/windows/pdb.json +++ b/volatility/framework/symbols/windows/pdb.json @@ -359,7 +359,6 @@ "LF_STRING_ID": 5637, "LF_UDT_SRC_LINE": 5638, "LF_UDT_MOD_SRC_LINE": 5639, - "LF_NUMERIC": 32768, "LF_CHAR": 32768, "LF_SHORT": 32769, "LF_USHORT": 32770,