Merge pull request #1735 from volatilityfoundation/issue_1732_pe_symbols

Fix issue when pe_symbols limited to searching one process. Remove ne…

volatility3/framework/plugins/windows/pe_symbols.py

@@ -229,7 +229,6 @@ class ExportSymbolFinder(PESymbolFinder):
         Returns:
             address: the address of the symbol, if found
         """
-
         for export in self._symbol_module:
             sym_name = self._get_name(export)
             if sym_name and sym_name == name:
@@ -413,8 +412,10 @@ class PESymbols(interfaces.plugins.PluginInterface):
         )
 
         for mod_name, unresolved_symbols in missing_symbols.items():
-            for symbol in unresolved_symbols:
-                vollog.debug(f"Unable to resolve symbol {symbol} in module {mod_name}")
+            for symbol_key, symbols in unresolved_symbols.items():
+                vollog.debug(
+                    f"Unable to resolve symbols {symbols} of type {symbol_key} in module {mod_name}"
+                )
 
         return found_symbols
 
@@ -632,7 +633,7 @@ class PESymbols(interfaces.plugins.PluginInterface):
     def _get_symbol_value(
         wanted_symbols: filter_module_info,
         symbol_resolver: PESymbolFinder,
-    ) -> Generator[Tuple[str, int, str, int], None, None]:
+    ) -> Generator[Tuple[str, str, int], None, None]:
         """
         Enumerates the symbols specified as wanted by the calling plugin
 
@@ -641,7 +642,7 @@ class PESymbols(interfaces.plugins.PluginInterface):
             symbol_resolver: method in a layer to resolve the symbols
 
         Returns:
-            Tuple[str, int, str, int]: the index and value of the found symbol in the wanted list, and the name and address of resolved symbol
+            Tuple[str, str, int]: the symbol identifier (key) of the found symbol in the wanted list, and the name and address of resolved symbol
         """
         if (
             wanted_names_identifier not in wanted_symbols
@@ -661,15 +662,25 @@ class PESymbols(interfaces.plugins.PluginInterface):
             # address or name
             if symbol_key in wanted_symbols:
                 # walk each wanted address or name
-                for value_index, wanted_value in enumerate(wanted_symbols[symbol_key]):
-                    symbol_value = symbol_getter(wanted_value)
 
+                # build dict in this function for debugging and tracking
+                all_wanted = []
+                for wanted_value in wanted_symbols[symbol_key]:
+                    all_wanted.append(wanted_value)
+
+                for value_index, wanted_value in enumerate(all_wanted):
+                    symbol_value = symbol_getter(wanted_value)
                     if symbol_value:
                         # yield out deleteion key, deletion index, symbol name, symbol address
                         if symbol_key == wanted_names_identifier:
-                            yield symbol_key, value_index, wanted_value, symbol_value  # type: ignore
+                            yield symbol_key, wanted_value, symbol_value
                         else:
-                            yield symbol_key, value_index, symbol_value, wanted_value  # type: ignore
+                            yield symbol_key, symbol_value, wanted_value
+
+                for value in all_wanted:
+                    vollog.debug(
+                        f"Unable to resolve value {value} using getter {symbol_getter}"
+                    )
 
     @classmethod
     def _validate_wanted_modules(
@@ -742,7 +753,7 @@ class PESymbols(interfaces.plugins.PluginInterface):
             PESymbols._find_symbols_through_exports,
         ]
 
-        found: found_symbols_module = []
+        found_symbols: found_symbols_module = []
 
         # the symbols wanted from this module by the caller
         wanted = wanted_modules[mod_name]
@@ -760,12 +771,17 @@ class PESymbols(interfaces.plugins.PluginInterface):
                 vollog.debug(f"Have resolver for method {method}")
                 for (
                     symbol_key,
-                    value_index,
                     symbol_name,
                     symbol_address,
                 ) in PESymbols._get_symbol_value(remaining, symbol_resolver):
-                    found.append((symbol_name, symbol_address))
-                    del remaining[symbol_key][value_index]
+                    found_symbols.append((symbol_name, symbol_address))
+
+                    if symbol_key == wanted_names_identifier:
+                        to_remove = symbol_name
+                    else:
+                        to_remove = symbol_address
+
+                    remaining[symbol_key].remove(to_remove)
 
                     # everything was resolved, stop this resolver
                     # remove this key from the remaining symbols to resolve
@@ -781,7 +797,7 @@ class PESymbols(interfaces.plugins.PluginInterface):
             if done_processing:
                 break
 
-        return found, remaining
+        return found_symbols, remaining
 
     @classmethod
     def find_symbols(
@@ -970,7 +986,8 @@ class PESymbols(interfaces.plugins.PluginInterface):
             Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files
         """
         procs = pslist.PsList.list_processes(
-            context=context, kernel_module_name=kernel_module_name
+            context=context,
+            kernel_module_name=kernel_module_name,
         )
 
         for proc in procs: