WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 09:34:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor symbol to object_type (so it doesn't shadow builtin type).

Browse Source
This commit is contained in:
Mike Auty
2019-08-14 20:50:42 +01:00
committed by ikelos
parent 18283ab410
commit be27aab8ae
27 changed files with 89 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/modules.py
+2 -2
View File
@@ -75,9 +75,9 @@ class Modules(interfaces.plugins.PluginInterface):
type_name = ldr_entry_type.type_name.split(constants.BANG)[1]
list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks")
module = ntkrnlmp.object(symbol = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
for mod in module.InLoadOrderLinks:
yield mod