From de87fd0b226cfca60395f9f2e67248d7e343e770 Mon Sep 17 00:00:00 2001
From: trashcan122 <ilay122@gmail.com>
Date: Wed, 9 Feb 2022 16:30:40 +0200
Subject: [PATCH] fix pdb mz parsing

---
 volatility3/framework/symbols/windows/pdbutil.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py
index ce492831e..cc7b22e03 100644
--- a/volatility3/framework/symbols/windows/pdbutil.py
+++ b/volatility3/framework/symbols/windows/pdbutil.py
@@ -131,8 +131,14 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
         # Check it is actually the MZ header
         if mz_sig != b"MZ":
             return None
-
-        nt_header_start = ord(layer.read(offset + 0x3C, 1))
+        
+        nt_header_start = struct.unpack("<I", layer.read(offset + 0x3C, 4))[0]
+        pe_sig = layer.read(offset + nt_header_start, 2)
+        
+        # Check it is actually the Nt Headers
+        if pe_sig != b"PE":
+            return None
+        
         optional_header_size = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))[0]
         # Just enough to tell us the max size
         pe_header = layer.read(offset, nt_header_start + 0x16 + optional_header_size)