diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index cda2dd615..9adde07b7 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -776,7 +776,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb - def get_peb32(self) -> interfaces.objects.ObjectInterface: + def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]: """Constructs a PEB32 object""" if constants.BANG not in self.vol.type_name: raise ValueError( @@ -834,6 +834,14 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb32 + def set_types(self, peb) -> str: + ldr_data = self._context.symbol_space.get_type( + self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" + ) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) + sym_table = self._32bit_table_name + return sym_table + def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" try: @@ -844,12 +852,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InLoadOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", @@ -868,12 +874,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InInitializationOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", @@ -891,12 +895,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InMemoryOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks",