diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 1176f4b04..0b57dcdbc 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -240,8 +240,11 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): st_other = struct.pack("B", sym.st_other) st_size = struct.pack(st_fmt, sym.st_size) - # The order as in the ELF specification - sym_data = st_name + st_info + st_other + st_shndx + st_value + st_size + # The order as in the ELF specification. The order is not the same between 32 and 64 bit symbols + if st_fmt == "