Merge pull request #682 from volatilityfoundation/release/v2.0.1

Release/v2.0.1
volatilityfoundation · Mar 17, 2022 · 20386d7 · 20386d7
2 parents 70375f2 + 59102aa
commit 20386d7
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 6 deletions.
diff --git a/doc/source/conf.py b/doc/source/conf.py
@@ -1,4 +1,4 @@
-# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 #
@@ -126,7 +126,7 @@ def setup(app):
 
 # General information about the project.
 project = 'Volatility 3'
-copyright = '2012-2019, Volatility Foundation'
+copyright = '2012-2022, Volatility Foundation'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the

diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py
@@ -40,7 +40,7 @@
 # We use the SemVer 2.0.0 versioning scheme
 VERSION_MAJOR = 2  # Number of releases of the library with a breaking change
 VERSION_MINOR = 0  # Number of changes that only add to the interface
-VERSION_PATCH = 0  # Number of changes that do not change the interface
+VERSION_PATCH = 1  # Number of changes that do not change the interface
 VERSION_SUFFIX = ""
 
 # TODO: At version 2.0.0, remove the symbol_shift feature

diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py
@@ -131,8 +131,14 @@ def get_guid_from_mz(cls, context: interfaces.context.ContextInterface, layer_na
         # Check it is actually the MZ header
         if mz_sig != b"MZ":
             return None
-
-        nt_header_start = ord(layer.read(offset + 0x3C, 1))
+
+        nt_header_start = struct.unpack("<I", layer.read(offset + 0x3C, 4))[0]
+        pe_sig = layer.read(offset + nt_header_start, 2)
+
+        # Check it is actually the Nt Headers
+        if pe_sig != b"PE":
+            return None
+
         optional_header_size = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))[0]
         # Just enough to tell us the max size
         pe_header = layer.read(offset, nt_header_start + 0x16 + optional_header_size)
@@ -357,4 +363,4 @@ def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[str, Any, b
 
                 guid = (16 * '{:02X}').format(g0, g1, g2, g3, g4, g5, g6, g7, g8, g9, ga, gb, gc, gd, ge, gf)
                 if match.start(0) < self.chunk_size:
-                    yield (guid, a, pdb_name, match.start(0))
+                    yield (guid, a, pdb_name, data_offset + match.start(0))