From 5cfd55eba872fd1f1c984b3c314459de3bf5ff6e Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Thu, 27 Mar 2025 17:17:08 -0500
Subject: [PATCH] ordering fix

---
 .../framework/symbols/linux/utilities/module_extract.py    | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py
index 1176f4b04..0b57dcdbc 100644
--- a/volatility3/framework/symbols/linux/utilities/module_extract.py
+++ b/volatility3/framework/symbols/linux/utilities/module_extract.py
@@ -240,8 +240,11 @@ class ModuleExtract(interfaces.configuration.VersionableInterface):
             st_other = struct.pack("B", sym.st_other)
             st_size = struct.pack(st_fmt, sym.st_size)
 
-            # The order as in the ELF specification
-            sym_data = st_name + st_info + st_other + st_shndx + st_value + st_size
+            # The order as in the ELF specification. The order is not the same between 32 and 64 bit symbols
+            if st_fmt == "<I":
+                sym_data = st_name + st_value + st_size + st_info + st_other + st_shndx
+            else:
+                sym_data = st_name + st_info + st_other + st_shndx + st_value + st_size
 
             # This should never happen regardless of smear or other issues in the data. We build the structure to spec.
             if len(sym_data) != sym_type.size: