WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 18:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up PE data construction code.

Browse Source
This commit is contained in:
Mike Auty
2018-12-13 18:33:42 +00:00
committed by ikelos
parent 9949809198
commit 6b480eed56
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/pe.py
+4 -3
View File
@@ -1,4 +1,3 @@
import struct
import typing
from volatility.framework import constants
@@ -54,7 +53,8 @@ class _IMAGE_DOS_HEADER(objects.Struct):
member_size = self._context.symbol_space.get_type(item.vol.type_name).size
start = item.vol.offset - sect.vol.offset
newval = struct.pack(item.vol.struct_format, int(value))
length, byteorder, signed = item.vol.struct_format
newval = objects.convert_data_to_value(value, int, length, byteorder, signed)
result = header[:start] + newval + header[start + member_size:]
return result
@@ -74,7 +74,8 @@ class _IMAGE_DOS_HEADER(objects.Struct):
image_base_offset = nt_header.OptionalHeader.ImageBase.vol.offset - self.vol.offset
image_base_type = nt_header.OptionalHeader.ImageBase.vol.type_name
member_size = self._context.symbol_space.get_type(image_base_type).size
newval = struct.pack(nt_header.OptionalHeader.ImageBase.vol.struct_format, int(self.vol.offset))
length, byteorder, signed = nt_header.OptionalHeader.ImageBase.vol.struct_format
newval = objects.convert_data_to_value(self.vol.offset, int, length, byteorder, signed)
return raw_data[:image_base_offset] + newval + raw_data[image_base_offset + member_size:]
def reconstruct(self) -> typing.Generator[typing.Tuple[int, bytes], None, None]: