Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/master' into local/swap-support
Browse files Browse the repository at this point in the history
  • Loading branch information
ikelos committed Feb 7, 2018
2 parents 8344497 + 152dc9a commit a57dbc3
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 2 deletions.
6 changes: 6 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,9 @@ workspace.xml
.mypy_cache
stubs
volatility/symbols/windows/*.pdb

# Mac metadata files
.DS_Store

# Volatility's config
config*.json
7 changes: 5 additions & 2 deletions volatility/framework/automagic/pdbscan.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

from volatility.framework import exceptions, layers, validity
from volatility.framework.layers import scanners
from volatility.framework.symbols import native, intermed
from volatility.framework.symbols import intermed, native

if __name__ == "__main__":
import sys
Expand Down Expand Up @@ -197,7 +197,10 @@ def recurse_symbol_fulfiller(self,
_kvo, kernel = self.valid_kernels[virtual_layer]
filter = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age']))
# Take the first result of search for the intermediate file
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__()
try:
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__()
except StopIteration:
isf_path = None
if isf_path:
vollog.debug("Using symbol library: {}".format(filter))
clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols"
Expand Down

0 comments on commit a57dbc3

Please sign in to comment.