WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updates to address the dlllist wow64 upgrades

Browse Source
This commit is contained in:
hsarkey
2025-02-05 15:10:36 -05:00
parent 830c28a7bb
commit 29567a777b
1 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+21 -19
View File
@@ -776,7 +776,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
)
return peb
def get_peb32(self) -> interfaces.objects.ObjectInterface:
def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]:
"""Constructs a PEB32 object"""
if constants.BANG not in self.vol.type_name:
raise ValueError(
@@ -834,6 +834,14 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
)
return peb32
def set_types(self, peb) -> str:
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
return sym_table
def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
"""Generator for DLLs in the order that they were loaded."""
try:
@@ -844,12 +852,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
"unsigned long"
):
sym_table = self.set_types(peb)
yield from peb.Ldr.InLoadOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InLoadOrderLinks",
@@ -868,12 +874,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
"unsigned long"
):
sym_table = self.set_types(peb)
yield from peb.Ldr.InInitializationOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InInitializationOrderLinks",
@@ -891,12 +895,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
"unsigned long"
):
sym_table = self.set_types(peb)
yield from peb.Ldr.InMemoryOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InMemoryOrderLinks",