From e0f08cdead558ffb6932df0dee2ef6a0003797ba Mon Sep 17 00:00:00 2001 From: Gohar Irfan Chaudhry Date: Tue, 13 Jul 2021 10:00:32 -0700 Subject: [PATCH] Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE The module field in `LF_UDT_MOD_SRC_LINE` should be `unsigned short` instead of `string` as per: ``` typedef struct lfUdtModSrcLine { unsigned short leaf; // LF_UDT_MOD_SRC_LINE CV_typ_t type; // UDT's type index CV_ItemId src; // index into string table where source file name is saved unsigned long line; // line number unsigned short imod; // module that contributes this UDT definition } lfUdtModSrcLine; ``` ([source](https://github.com/microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/include/cvinfo.h#L1707)) This also changes the size of the struct from 16 to 14. --- volatility3/framework/symbols/windows/pdb.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdb.json b/volatility3/framework/symbols/windows/pdb.json index 049680326..8c365a72b 100644 --- a/volatility3/framework/symbols/windows/pdb.json +++ b/volatility3/framework/symbols/windows/pdb.json @@ -1349,12 +1349,12 @@ "offset": 12, "type": { "kind": "base", - "name": "string" + "name": "unsigned short" } } }, "kind": "struct", - "size": 16 + "size": 14 }, "LF_UNION": { "fields": {