From d172e1271716c27e1c3d0145fb651eef552916d8 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 08:08:57 -0500 Subject: [PATCH] Updated fixes after internal review. Allows windows.dlllist to report back DLLs from wow64 processes. --- .../symbols/windows/extensions/__init__.py | 73 ++++++++----------- 1 file changed, 31 insertions(+), 42 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 2b73fa625..3ac737ac8 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -790,13 +790,13 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): # Determine if process is running under WOW64. if self.get_is_wow64(): - peb32 = self.get_wow_64_process() + proc = self.get_wow_64_process() else: return None # Confirm WoW64Process points to a valid process address - if not proc_layer.is_valid(peb32): + if not proc_layer.is_valid(proc): raise exceptions.InvalidAddressException( - proc_layer_name, peb32, f"Invalid Wow64Process address at {self.Peb:0x}" + proc_layer_name, proc, f"Invalid Wow64Process address at {self.Peb:0x}" ) # Leverage the context of existing symbol table to help configure @@ -816,50 +816,41 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): if self._context.symbol_space.has_type( sym_table + constants.BANG + "_EWOW64PROCESS" ): - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32.Peb, - ) - return peb32 + offset=proc.Peb # vista sp0-sp1 and 2003 sp1-sp2 elif self._context.symbol_space.has_type( sym_table + constants.BANG + "_WOW64_PROCESS" ): - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32.Wow64, - ) - return peb32 + offset=proc.Wow64 else: - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32, - ) - return peb32 + offset=proc + + peb32 = self._context.object( + f"{self._32bit_table_name}{constants.BANG}_PEB32", + layer_name=proc_layer_name, + offset=offset, + ) + return peb32 def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InLoadOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", ): yield entry @@ -871,20 +862,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InInitializationOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", ): yield entry @@ -895,20 +885,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they appear in memory""" try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InMemoryOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks", ): yield entry