From fda15122737ca3d5b8cdbc00131be59e6841ac6e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 29 Jul 2021 00:05:36 +0100 Subject: [PATCH] Windows: Fix pdbconv handling of unknown types --- volatility3/framework/symbols/windows/pdbconv.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index fe61aa10d..b48e8268c 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -770,7 +770,8 @@ class PdbReader: consumed = leaf_type.vol.base_type.size remaining = length - consumed - type_handler, has_name, value_attribute = self.type_handlers.get(leaf_type.lookup(), 'LF_UNKNOWN') + type_handler, has_name, value_attribute = self.type_handlers.get(leaf_type.lookup(), + ('LF_UNKNOWN', False, None)) if type_handler in ['LF_FIELDLIST']: sub_length = remaining