diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility/framework/symbols/windows/extensions/pe.py index f77a87e13..615ec788d 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility/framework/symbols/windows/extensions/pe.py @@ -1,4 +1,3 @@ -import struct import typing from volatility.framework import constants @@ -54,7 +53,8 @@ class _IMAGE_DOS_HEADER(objects.Struct): member_size = self._context.symbol_space.get_type(item.vol.type_name).size start = item.vol.offset - sect.vol.offset - newval = struct.pack(item.vol.struct_format, int(value)) + length, byteorder, signed = item.vol.struct_format + newval = objects.convert_data_to_value(value, int, length, byteorder, signed) result = header[:start] + newval + header[start + member_size:] return result @@ -74,7 +74,8 @@ class _IMAGE_DOS_HEADER(objects.Struct): image_base_offset = nt_header.OptionalHeader.ImageBase.vol.offset - self.vol.offset image_base_type = nt_header.OptionalHeader.ImageBase.vol.type_name member_size = self._context.symbol_space.get_type(image_base_type).size - newval = struct.pack(nt_header.OptionalHeader.ImageBase.vol.struct_format, int(self.vol.offset)) + length, byteorder, signed = nt_header.OptionalHeader.ImageBase.vol.struct_format + newval = objects.convert_data_to_value(self.vol.offset, int, length, byteorder, signed) return raw_data[:image_base_offset] + newval + raw_data[image_base_offset + member_size:] def reconstruct(self) -> typing.Generator[typing.Tuple[int, bytes], None, None]: