diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index a631e669f..a6feafe1a 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -124,14 +124,16 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): # TODO: Consider whether a single found kernel can fulfill multiple requirements if self.potential_kernels: kernel = self.potential_kernels[0] - suffix = kernel['pdb_name'] + "-" + kernel['GUID'] + "-" + str(kernel['age']) + ".json" # Check user symbol directory first, then fallback to the framework's library to allow for overloading prefixes = [os.path.join(os.path.dirname(__file__), "..", "..", "symbols", "windows"), os.path.join(os.path.dirname(__file__), "..", "symbols", "windows")] + midfix = kernel['pdb_name'] + "-" + kernel['GUID'] + "-" + str(kernel['age']) + suffixes = ['.json', '.json.xz'] idd_path = None for prefix in prefixes: - if os.path.exists(os.path.join(prefix, suffix)): - idd_path = "file://" + os.path.abspath(os.path.join(prefix, suffix)) + for suffix in suffixes: + if os.path.exists(os.path.join(prefix, midfix + suffix)): + idd_path = "file://" + os.path.abspath(os.path.join(prefix, midfix + suffix)) if idd_path: clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols" # Set the discovered options @@ -140,7 +142,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): # Construct the appropriate symbol table requirement.construct(context, config_path) else: - vollog.debug("Symbol library path not found: {}".format(suffix)) + vollog.debug("Symbol library path not found: {}".format(midfix + suffix)) else: for subreq in requirement.requirements.values(): self.recurse_symbol_fulfiller(context, sub_config_path, subreq) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index abc577158..a4f4e553f 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -1,6 +1,7 @@ import copy import json import logging +import lzma import urllib.parse from volatility import schemas @@ -33,8 +34,12 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): # Open the file and test the version self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) - with open(url.path, "r") as fp: - json_object = json.load(fp) + if url.path.endswith('.xz'): + fp = lzma.open(url.path, 'rt') + else: + fp = open(url.path, "r") + json_object = json.load(fp) + fp.close() # Validation is expensive, but we cache to store the hashes of successfully validated json objects if not schemas.validate(json_object):