Process ntkrnlmp.pdb except

[55-AA]

the file link is:
http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/A32C55CDEBC1441DAC80552A86F5F11F1/ntkrnlmp.pdb

Traceback (most recent call last):
File "/usr/local/bin/pdb_print_gvars.py", line 56, in
main(args[0], args[1])
File "/usr/local/bin/pdb_print_gvars.py", line 23, in main
pdb = pdbparse.parse(filename)
File "/usr/local/lib64/python3.6/site-packages/pdbparse/init.py", line 554, in parse
return PDB7(f, fast_load)
File "/usr/local/lib64/python3.6/site-packages/pdbparse/init.py", line 521, in init
self.read_root(self.root_stream)
File "/usr/local/lib64/python3.6/site-packages/pdbparse/init.py", line 467, in read_root
parent = self))
File "/usr/local/lib64/python3.6/site-packages/pdbparse/init.py", line 154, in init
self.load()
File "/usr/local/lib64/python3.6/site-packages/pdbparse/init.py", line 262, in load
tpis = tpi.parse_stream(self.stream_file, unnamed_hack, elim_fwdrefs)
File "/usr/local/lib64/python3.6/site-packages/pdbparse/tpi.py", line 1160, in parse_stream
tpi_stream = TPIStream.parse_stream(fp)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 300, in parse_stream
return self._parsereport(stream, context, "(parsing)")
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2653, in _parse
return self.subcon._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2120, in _parse
subobj = sc._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2653, in _parse
return self.subcon._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2413, in _parse
e = self.subcon._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2653, in _parse
return self.subcon._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2120, in _parse
subobj = sc._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 2653, in _parse
return self.subcon._parsereport(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 5040, in _parse
stream2 = io.BytesIO(data._parsereport(stream, context, path))
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 848, in _parse
return stream_read(stream, length, path)
File "/usr/local/lib/python3.6/site-packages/construct/core.py", line 91, in stream_read
raise StreamError("stream read less than specified amount, expected %d, found %d" % (length, len(data)), path=path)
construct.core.StreamError: Error in path (parsing) -> TPIStream -> types -> types -> type_data
stream read less than specified amount, expected 94, found 0

[moyix]

What version of Windows does this kernel PDB come from? I wonder if it's related to the fact that the PDB format changed a bit recently?

See this Volatility issue: volatilityfoundation/volatility3#516

[changliu98]

Got issue with pdbparse too, always shows an KeyError on any pdb file