From 7096f1853f864abc82e20e06dbc168521971faeb Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 21 Feb 2017 18:07:51 +0000 Subject: [PATCH] refer to self's symbol table when constructing objects inside an extension --- .../framework/symbols/windows/extensions/__init__.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 923c723fe..dbc31aaf6 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -60,18 +60,18 @@ class _EPROCESS(objects.Struct): return preferred_name def load_order_modules(self): + """Generator for DLLs in the order that they were loaded""" - config_prefix = "dlllist" - proc_layer_name = self.add_process_layer(self._context, config_prefix) + proc_layer_name = self.add_process_layer(self._context) proc_layer = self._context.memory[proc_layer_name] if not proc_layer.is_valid(self.Peb): raise StopIteration - object_factory = self._context.object_factory("ntkrnlmp") - peb = object_factory("_PEB", layer_name = proc_layer_name, offset = self.Peb) + sym_table = self.vol.type_name.split("!")[0] + peb = self._context.object("{}!_PEB".format(sym_table), layer_name = proc_layer_name, offset = self.Peb) - for entry in peb.Ldr.InLoadOrderModuleList.to_list("ntkrnlmp!_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"): + for entry in peb.Ldr.InLoadOrderModuleList.to_list("{}!_LDR_DATA_TABLE_ENTRY".format(sym_table), "InLoadOrderLinks"): yield entry class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):