WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

refer to self's symbol table when constructing objects inside an extension

Browse Source
This commit is contained in:
iMHLv2
2017-02-21 18:07:51 +00:00
parent efd2468639
commit 7096f1853f
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+5 -5
View File
@@ -60,18 +60,18 @@ class _EPROCESS(objects.Struct):
return preferred_name
def load_order_modules(self):
"""Generator for DLLs in the order that they were loaded"""
config_prefix = "dlllist"
proc_layer_name = self.add_process_layer(self._context, config_prefix)
proc_layer_name = self.add_process_layer(self._context)
proc_layer = self._context.memory[proc_layer_name]
if not proc_layer.is_valid(self.Peb):
raise StopIteration
object_factory = self._context.object_factory("ntkrnlmp")
peb = object_factory("_PEB", layer_name = proc_layer_name, offset = self.Peb)
sym_table = self.vol.type_name.split("!")[0]
peb = self._context.object("{}!_PEB".format(sym_table), layer_name = proc_layer_name, offset = self.Peb)
for entry in peb.Ldr.InLoadOrderModuleList.to_list("ntkrnlmp!_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"):
for entry in peb.Ldr.InLoadOrderModuleList.to_list("{}!_LDR_DATA_TABLE_ENTRY".format(sym_table), "InLoadOrderLinks"):
yield entry
class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):