From f2e3df27f48c09e75d42dc56419698ef8e5001af Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 21 Feb 2022 14:57:31 +0200 Subject: [PATCH] fix read whole module --- volatility3/framework/symbols/windows/pdbutil.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 35bc62d18..585e96b6d 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -146,7 +146,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): max_size = pe_data.OPTIONAL_HEADER.SizeOfImage # Proper data - virtual_data = layer.read(offset, max_size) + virtual_data = layer.read(offset, max_size, pad=True) pe_data = pefile.PE(data = virtual_data) # De-virtualize the memory