WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updated fixes after internal review. Allows windows.dlllist to report back DLLs from wow64 processes.

Browse Source
This commit is contained in:
hsarkey
2025-01-24 13:24:33 -05:00
parent c317cad835
commit d172e12717
1 changed files with 31 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+31 -42
View File
@@ -790,13 +790,13 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
# Determine if process is running under WOW64.
if self.get_is_wow64():
peb32 = self.get_wow_64_process()
proc = self.get_wow_64_process()
else:
return None
# Confirm WoW64Process points to a valid process address
if not proc_layer.is_valid(peb32):
if not proc_layer.is_valid(proc):
raise exceptions.InvalidAddressException(
proc_layer_name, peb32, f"Invalid Wow64Process address at {self.Peb:0x}"
proc_layer_name, proc, f"Invalid Wow64Process address at {self.Peb:0x}"
)
# Leverage the context of existing symbol table to help configure
@@ -816,50 +816,41 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
if self._context.symbol_space.has_type(
sym_table + constants.BANG + "_EWOW64PROCESS"
):
peb32 = self._context.object(
f"{self._32bit_table_name}{constants.BANG}_PEB32",
layer_name=proc_layer_name,
offset=peb32.Peb,
)
return peb32
offset=proc.Peb
# vista sp0-sp1 and 2003 sp1-sp2
elif self._context.symbol_space.has_type(
sym_table + constants.BANG + "_WOW64_PROCESS"
):
peb32 = self._context.object(
f"{self._32bit_table_name}{constants.BANG}_PEB32",
layer_name=proc_layer_name,
offset=peb32.Wow64,
)
return peb32
offset=proc.Wow64
else:
peb32 = self._context.object(
f"{self._32bit_table_name}{constants.BANG}_PEB32",
layer_name=proc_layer_name,
offset=peb32,
)
return peb32
offset=proc
peb32 = self._context.object(
f"{self._32bit_table_name}{constants.BANG}_PEB32",
layer_name=proc_layer_name,
offset=offset,
)
return peb32
def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
"""Generator for DLLs in the order that they were loaded."""
try:
pebs = [
[self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
[self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
self.get_peb(), self.get_peb32(),
]
for peb, table_name in pebs:
if peb != None:
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
Ldr_data = self._context.symbol_space.get_type(
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
for entry in peb.Ldr.InLoadOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + table_name,
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InLoadOrderLinks",
):
yield entry
@@ -871,20 +862,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
try:
pebs = [
[self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
[self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
self.get_peb(), self.get_peb32(),
]
for peb, table_name in pebs:
if peb != None:
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
Ldr_data = self._context.symbol_space.get_type(
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
for entry in peb.Ldr.InInitializationOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + table_name,
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InInitializationOrderLinks",
):
yield entry
@@ -895,20 +885,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
"""Generator for DLLs in the order that they appear in memory"""
try:
pebs = [
[self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
[self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
self.get_peb(), self.get_peb32(),
]
for peb, table_name in pebs:
if peb != None:
for peb in pebs:
if peb:
sym_table = self.get_symbol_table_name()
if peb.Ldr.vol.type_name.endswith("unsigned long"):
Ldr_data = self._context.symbol_space.get_type(
ldr_data = self._context.symbol_space.get_type(
self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
)
peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
sym_table = self._32bit_table_name
for entry in peb.Ldr.InMemoryOrderModuleList.to_list(
f"{sym_table}{constants.BANG}" + table_name,
f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
"InMemoryOrderLinks",
):
yield entry