From 8bd7daf28fdbaf95dcfce1cfaa4e25517d24cd71 Mon Sep 17 00:00:00 2001
From: Paul Kermann <paulkermann@tutanota.com>
Date: Mon, 2 May 2022 09:33:41 +0300
Subject: [PATCH] fix minor improvments

---
 volatility3/framework/interfaces/objects.py            | 10 +---------
 volatility3/framework/interfaces/symbols.py            |  2 +-
 volatility3/framework/symbols/windows/__init__.py      |  8 ++++----
 .../framework/symbols/windows/extensions/__init__.py   |  6 +++++-
 4 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py
index 8c7167a78..98ceca3d0 100644
--- a/volatility3/framework/interfaces/objects.py
+++ b/volatility3/framework/interfaces/objects.py
@@ -116,14 +116,6 @@ class ObjectInterface(metaclass = abc.ABCMeta):
         normalized_offset = object_info.offset & mask
 
         vol_info_dict = {'type_name': type_name, 'offset': normalized_offset}
-        if constants.BANG in type_name:
-            table_name, struct_name = type_name.split(constants.BANG)
-            vol_info_dict["table_name"] = table_name
-            vol_info_dict["short_name"] = struct_name
-        else:
-            vol_info_dict["table_name"] = ""
-            vol_info_dict["short_name"] = type_name
-        
         self._vol = collections.ChainMap({}, vol_info_dict, object_info, kwargs)
         self._context = context
 
@@ -151,7 +143,7 @@ class ObjectInterface(metaclass = abc.ABCMeta):
         """
         if constants.BANG not in self.vol.type_name:
             raise ValueError(f"Unable to determine table for symbol: {self.vol.type_name}")
-        table_name = self.vol.table_name
+        table_name = self.vol.type_name[:self.vol.type_name.index(constants.BANG)]
         if table_name not in self._context.symbol_space:
             raise KeyError(f"Symbol table not found in context's symbol_space for symbol: {self.vol.type_name}")
         return table_name
diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py
index 99690054d..9f2cb9fc9 100644
--- a/volatility3/framework/interfaces/symbols.py
+++ b/volatility3/framework/interfaces/symbols.py
@@ -167,7 +167,7 @@ class BaseSymbolTableInterface:
         """
         raise NotImplementedError("Abstract method set_type_class not implemented yet.")
 
-    def try_set_type_class(self, name: str, clazz: Type[objects.ObjectInterface]) -> bool:
+    def optional_set_type_class(self, name: str, clazz: Type[objects.ObjectInterface]) -> bool:
         """Calls the set_type_class function but does not throw an exception.
         Returns whether setting the type class was successfull.
         Args:
diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py
index 468d998c4..b5129bb04 100755
--- a/volatility3/framework/symbols/windows/__init__.py
+++ b/volatility3/framework/symbols/windows/__init__.py
@@ -42,7 +42,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('_IMAGE_NT_HEADERS', pe.IMAGE_NT_HEADERS)
         
         # Might not exist in 32-bit operating systems.
-        self.try_set_type_class('_IMAGE_NT_HEADERS64', pe.IMAGE_NT_HEADERS)
+        self.optional_set_type_class('_IMAGE_NT_HEADERS64', pe.IMAGE_NT_HEADERS)
 
         # This doesn't exist in very specific versions of windows
         try:
@@ -54,11 +54,11 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
             pass
 
         # these don't exist in windows XP
-        self.try_set_type_class('_MMADDRESS_NODE', extensions.MMVAD_SHORT)
+        self.optional_set_type_class('_MMADDRESS_NODE', extensions.MMVAD_SHORT)
         
         # these were introduced starting in windows 8
-        self.try_set_type_class('_MM_AVL_NODE', extensions.MMVAD_SHORT)
+        self.optional_set_type_class('_MM_AVL_NODE', extensions.MMVAD_SHORT)
         
         # these were introduced starting in windows 7
-        self.try_set_type_class('_RTL_BALANCED_NODE', extensions.MMVAD_SHORT)
+        self.optional_set_type_class('_RTL_BALANCED_NODE', extensions.MMVAD_SHORT)
         
\ No newline at end of file
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index 2f0f2388c..e7da0316d 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -576,7 +576,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
             raise exceptions.InvalidAddressException(proc_layer_name, self.Peb,
                                                      f"Invalid Peb address at {self.Peb:0x}")
 
-        return self.at_layer(proc_layer_name).Peb
+        sym_table = self.get_symbol_table_name()
+        peb = self._context.object(f"{sym_table}{constants.BANG}_PEB",
+                                   layer_name = proc_layer_name,
+                                   offset = self.Peb)
+        return peb
 
     def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Generator for DLLs in the order that they were loaded."""