From daef7df46f5d8cd12bb0ef447310185e691f571a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 13 Oct 2021 14:18:25 +0100 Subject: [PATCH] Windows: Improve PDB scanning regex The regular expression for finding PDB signatures didn't have an apprioriate flag to treat newline characters like normal characters, meaning that if a newline character occurred between the RSDS header and the name of the pdb file, the pdb signature would be missed. Also updated the filenames so that they're escaped, meaning it must be an actual dot for the extension rather than any character. Fixes #577 --- volatility3/framework/symbols/windows/pdbutil.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index e73c25d48..4e90e4834 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -346,8 +346,9 @@ class PdbSignatureScanner(interfaces.layers.ScannerInterface): self._pdb_names = pdb_names def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[str, Any, bytes, int], None, None]: - pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join(self._pdb_names) + b')\x00' - for match in re.finditer(pattern, data): + pattern = b'RSDS' + (b'.' * self._RSDS_format.size) + b'(' + b'|'.join( + [re.escape(x) for x in self._pdb_names]) + b')\x00' + for match in re.finditer(pattern, data, flags = re.DOTALL): pdb_name = data[match.start(0) + 4 + self._RSDS_format.size:match.start(0) + len(match.group()) - 1] if pdb_name in self._pdb_names: ## this ordering is intentional due to mixed endianness in the GUID