From f251a1db15f24fca65dc27df01cc438093204d26 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Fri, 5 Mar 2021 01:10:26 +0000
Subject: [PATCH] Windows: Update PDB code to work without cache

---
 .../framework/symbols/windows/pdbconv.py      | 21 ++++++++++++-------
 .../framework/symbols/windows/pdbutil.py      | 10 ++++++---
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py
index 6d50c9a58..9bb51ae83 100644
--- a/volatility3/framework/symbols/windows/pdbconv.py
+++ b/volatility3/framework/symbols/windows/pdbconv.py
@@ -9,9 +9,10 @@ import json
 import logging
 import lzma
 import os
+import urllib
 from bisect import bisect
 from typing import Tuple, Dict, Any, Optional, Union, List
-from urllib import request, error
+from urllib import request, error, parse
 
 from volatility3.framework import contexts, interfaces, constants
 from volatility3.framework.layers import physical, msf, resources
@@ -937,17 +938,17 @@ class PdbRetreiver:
             for suffix in [file_name, file_name[:-1] + '_']:
                 try:
                     vollog.debug("Attempting to retrieve {}".format(url + suffix))
-                    # Don't cache the PDB files since they might build up and there's little benefit
+                    # We no longer cache it, so this is a glorified remote endpoint check
                     result = resources.ResourceAccessor(progress_callback, enable_cache = False).open(url + suffix)
                 except (error.HTTPError, error.URLError) as excp:
                     vollog.debug("Failed with {}".format(excp))
-            if result:
-                break
+                if result:
+                    break
         if progress_callback is not None:
             progress_callback(100, "Downloading {}".format(url + suffix))
         if result is None:
             return None
-        return result.name
+        return url + suffix
 
 
 if __name__ == '__main__':
@@ -1008,9 +1009,13 @@ if __name__ == '__main__':
         parser.error("No suitable filename provided or retrieved")
 
     ctx = contexts.Context()
-    if not os.path.exists(filename):
-        parser.error("File {} does not exists".format(filename))
-    location = "file:" + request.pathname2url(filename)
+    url = parse.urlparse(filename, scheme = 'file')
+    if url.scheme == 'file':
+        if not os.path.exists(filename):
+            parser.error("File {} does not exists".format(filename))
+        location = "file:" + request.pathname2url(os.path.abspath(filename))
+    else:
+        location = filename
 
     convertor = PdbReader(ctx, location, database_name = args.pattern, progress_callback = pg_cb)
 
diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py
index 7e39cbc1a..ac7357f6a 100644
--- a/volatility3/framework/symbols/windows/pdbutil.py
+++ b/volatility3/framework/symbols/windows/pdbutil.py
@@ -9,7 +9,7 @@ import lzma
 import os
 import struct
 from typing import Any, Dict, Generator, List, Optional, Tuple, Union
-from urllib import request
+from urllib import request, parse
 
 from volatility3 import symbols
 from volatility3.framework import constants, interfaces
@@ -196,8 +196,12 @@ class PDBUtility:
                                                                    file_name = pdb_name,
                                                                    progress_callback = progress_callback)
                     if filename:
-                        tmp_files.append(filename)
-                        location = "file:" + request.pathname2url(tmp_files[-1])
+                        url = parse.urlparse(filename, scheme = 'file')
+                        if url.scheme == 'file' or len(url.scheme) == 1:
+                            tmp_files.append(filename)
+                            location = "file:" + request.pathname2url(os.path.abspath(tmp_files[-1]))
+                        else:
+                            location = filename
                         json_output = pdbconv.PdbReader(context, location, pdb_name, progress_callback).get_json()
                         of.write(bytes(json.dumps(json_output, indent = 2, sort_keys = True), 'utf-8'))
                         # After we've successfully written it out, record the fact so we don't clear it out