diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index e73c25d48..4e90e4834 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -346,8 +346,9 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface): self._pdb_names = pdb_names def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[str, Any, bytes, int], None, None]: - pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join(self._pdb_names) + b')\x00' - for match in re.finditer(pattern, data): + pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join( + [re.escape(x) for x in self._pdb_names]) + b')\x00' + for match in re.finditer(pattern, data, flags = re.DOTALL): pdb_name = data[match.start(0) + 4 + self._RSDS_format.size:match.start(0) + len(match.group()) - 1] if pdb_name in self._pdb_names: ## this ordering is intentional due to mixed endianness in the GUID