--- /usr/bin/pmodump.pl.orig 2006-01-11 09:31:07.000000000 -0500 +++ /usr/bin/pmodump.pl 2008-03-11 12:50:44.000000000 -0400 @@ -40,26 +40,32 @@ # printf "0x%08x == 0x%08x ?\n", $offset, $selfref; if ($offset == $selfref ) { printf("Possible PDB block detected at 0x%x\n", $offset); + push(@pdb, $offset); } - push(@pdb, $offset); $offset += 4096; } for my $off (@pdb) { my ($ff, $ldr, $params, $ppbuf); - my $peb = logical2physical(0x7ffdf000,$off); - seek(IN, $peb+4, 0); - read(IN, $ff, 4); - read(IN, $buf, 4); - read(IN, $ldr, 4); - read(IN, $params, 4); - my $pebldr = unpack("I", $ldr); - my $ppebldr = logical2physical($pebldr, $off); - my $processparams = unpack("I", $params); - my $baseaddr = unpack("I", $buf); - my $pba = logical2physical($baseaddr, $off); - seek(IN, $pba, 0); - read(IN, $buf, 2); - read(IN, $buf2, 1022); + my ($i, $peb, $pebldr, $ppebldr, $processparams, $pba, $baseaddr); + printf "offset = 0x%08x \n", $off,; + for ($i=0x7ffd3000; $i<=0x7ffdf000; $i+=0x1000) { + $peb = logical2physical($i,$off); + seek(IN, $peb+4, 0); + read(IN, $ff, 4); + read(IN, $buf, 4); + read(IN, $ldr, 4); + read(IN, $params, 4); + $pebldr = unpack("I", $ldr); + $ppebldr = logical2physical($pebldr, $off); + $processparams = unpack("I", $params); + $baseaddr = unpack("I", $buf); + $pba = logical2physical($baseaddr, $off); + next if ($pba == 0); + seek(IN, $pba, 0); + read(IN, $buf, 2); + read(IN, $buf2, 1022); + last if ($ff eq "\xff\xff\xff\xff" && $buf eq "MZ"); + } my $ipeb = 0x7ffdf000; if ($ff eq "\xff\xff\xff\xff" && $buf eq "MZ") {