From 017d83fa775e6d7bec229a51fdcc73dc25b03cf4 Mon Sep 17 00:00:00 2001 From: Antoine Date: Wed, 24 Jul 2019 10:13:10 +0000 Subject: [PATCH] Fix reading of resource directory strings --- volatility/plugins/overlays/windows/pe_vtypes.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/overlays/windows/pe_vtypes.py b/volatility/plugins/overlays/windows/pe_vtypes.py index 554f1f47e..c66e0b0d8 100644 --- a/volatility/plugins/overlays/windows/pe_vtypes.py +++ b/volatility/plugins/overlays/windows/pe_vtypes.py @@ -979,7 +979,7 @@ def v(self): length = self.Length.v() if length > 1024: length = 0 - data = self.obj_vm.read(self.Value.obj_offset, length) + data = self.obj_vm.read(self.Value.obj_offset, length * 2) return data.decode("utf16", "ignore").encode("ascii", 'backslashreplace') except Exception, _e: return '' @@ -1042,4 +1042,4 @@ def modification(self, profile): '_VS_FIXEDFILEINFO': _VS_FIXEDFILEINFO, '_VS_VERSION_INFO': _VS_VERSION_INFO, 'VerStruct': VerStruct, - }) \ No newline at end of file + })