From 58ed4938a65251da19ddbf46d524c3dd7645c151 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 22 Apr 2025 09:50:50 -0500 Subject: [PATCH] Windows Modules: Walk list in both forward + backward directions Traversing the `InLoadOrderModules` linked list yields many additional entries vs the forward-only approach. --- .../framework/plugins/windows/modules.py | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 1ec965737..34f923168 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,9 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Generator, Iterable, List, Optional, Dict, Tuple +from typing import Dict, Generator, Iterable, List, Optional, Tuple -from volatility3.framework import symbols, constants, exceptions, interfaces, renderers +from volatility3.framework import constants, exceptions, interfaces, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed @@ -342,7 +342,24 @@ class Modules(interfaces.plugins.PluginInterface): object_type=type_name, offset=list_entry.vol.offset - reloff, absolute=True ) - yield from module.InLoadOrderLinks + seen = set() + for mod in module.InLoadOrderLinks.to_list( + symbol_type=ldr_entry_type.vol.type_name, member="InLoadOrderLinks" + ): + if mod.vol.offset not in seen: + seen.add(mod.vol.offset) + + yield mod + + for mod in module.InLoadOrderLinks.to_list( + symbol_type=ldr_entry_type.vol.type_name, + member="InLoadOrderLinks", + forward=False, + ): + if mod.vol.offset not in seen: + seen.add(mod.vol.offset) + + yield mod def run(self): return renderers.TreeGrid(