diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 35bc62d18..585e96b6d 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -146,7 +146,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): max_size = pe_data.OPTIONAL_HEADER.SizeOfImage # Proper data - virtual_data = layer.read(offset, max_size) + virtual_data = layer.read(offset, max_size, pad=True) pe_data = pefile.PE(data = virtual_data) # De-virtualize the memory