WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Improve PDB scanning regex

Browse Source 
The regular expression for finding PDB signatures didn't have an
apprioriate flag to treat newline characters like normal characters,
meaning that if a newline character occurred between the RSDS header
and the name of the pdb file, the pdb signature would be missed.

Also updated the filenames so that they're escaped, meaning it must be
an actual dot for the extension rather than any character.

Fixes #577
This commit is contained in:
Mike Auty
2021-10-13 14:18:25 +01:00
parent 2d39dc5a91
commit daef7df46f
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/pdbutil.py
+3 -2
View File
@@ -346,8 +346,9 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface):
self._pdb_names = pdb_names
def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[str, Any, bytes, int], None, None]:
pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join(self._pdb_names) + b')\x00'
for match in re.finditer(pattern, data):
pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join(
[re.escape(x) for x in self._pdb_names]) + b')\x00'
for match in re.finditer(pattern, data, flags = re.DOTALL):
pdb_name = data[match.start(0) + 4 + self._RSDS_format.size:match.start(0) + len(match.group()) - 1]
if pdb_name in self._pdb_names:
## this ordering is intentional due to mixed endianness in the GUID