diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility/framework/symbols/windows/pdbutil.py index 196cfc526..8462f4216 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility/framework/symbols/windows/pdbutil.py @@ -3,6 +3,7 @@ # import binascii +import io import json import logging import lzma @@ -16,6 +17,7 @@ from volatility.framework import constants, interfaces from volatility.framework.configuration.requirements import SymbolTableRequirement from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import pdbconv +from volatility.framework.symbols.windows.extensions import pe vollog = logging.getLogger(__name__) @@ -124,21 +126,36 @@ class PDBUtility: if mz_sig != b"MZ": return None - nt_header_start = ord(layer.read(offset + 0x3C, 1)) - optional_header_size = struct.unpack('