diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 675075a70..a367e4faf 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -712,6 +712,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): return True + def add_process_layer(self, config_prefix: str = None, preferred_name: str = None): """Constructs a new layer based on the process's DirectoryTableBase.""" @@ -735,9 +736,8 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): # Add the constructed layer and return the name return self._add_process_layer(self._context, dtb, config_prefix, preferred_name) - def load_order_modules(self) -> Iterable[int]: - """Generator for DLLs in the order that they were loaded.""" - + def get_peb(self) -> interfaces.objects.ObjectInterface: + """Constructs a PEB object""" if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) @@ -751,51 +751,30 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), layer_name = proc_layer_name, offset = self.Peb) + return peb + def load_order_modules(self) -> Iterable[int]: + """Generator for DLLs in the order that they were loaded.""" + + peb = self.get_peb() for entry in peb.Ldr.InLoadOrderModuleList.to_list( - "{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InLoadOrderLinks"): + "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InLoadOrderLinks"): yield entry def init_order_modules(self) -> Iterable[int]: """Generator for DLLs in the order that they were loaded.""" - if constants.BANG not in self.vol.type_name: - raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) - - proc_layer_name = self.add_process_layer() - - proc_layer = self._context.layers[proc_layer_name] - if not proc_layer.is_valid(self.Peb): - return - - sym_table = self.vol.type_name.split(constants.BANG)[0] - peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), - layer_name = proc_layer_name, - offset = self.Peb) - + peb = self.get_peb() for entry in peb.Ldr.InInitializationOrderModuleList.to_list( - "{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InInitializationOrderLinks"): + "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InInitializationOrderLinks"): yield entry def mem_order_modules(self) -> Iterable[int]: """Generator for DLLs in the order that they were loaded.""" - if constants.BANG not in self.vol.type_name: - raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) - - proc_layer_name = self.add_process_layer() - - proc_layer = self._context.layers[proc_layer_name] - if not proc_layer.is_valid(self.Peb): - return - - sym_table = self.vol.type_name.split(constants.BANG)[0] - peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), - layer_name = proc_layer_name, - offset = self.Peb) - + peb = self.get_peb() for entry in peb.Ldr.InMemoryOrderModuleList.to_list( - "{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InMemoryOrderLinks"): + "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InMemoryOrderLinks"): yield entry def get_handle_count(self):