diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 3ac737ac8..9c4fbb1b6 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -816,17 +816,17 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): if self._context.symbol_space.has_type( sym_table + constants.BANG + "_EWOW64PROCESS" ): - offset=proc.Peb + offset = proc.Peb # vista sp0-sp1 and 2003 sp1-sp2 elif self._context.symbol_space.has_type( sym_table + constants.BANG + "_WOW64_PROCESS" ): - offset=proc.Wow64 + offset = proc.Wow64 else: - offset=proc - + offset = proc + peb32 = self._context.object( f"{self._32bit_table_name}{constants.BANG}_PEB32", layer_name=proc_layer_name, @@ -838,7 +838,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they were loaded.""" try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: @@ -850,7 +851,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InLoadOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", ): yield entry @@ -862,7 +863,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: @@ -885,7 +887,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they appear in memory""" try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: