Updated fixes after internal review. Allows windows.dlllist to report back DLLs from wow64 processes.

Author: hsarkey

volatility3/framework/symbols/windows/extensions/__init__.py

@@ -759,13 +759,13 @@ def get_peb32(self) -> interfaces.objects.ObjectInterface:
 
         # Determine if process is running under WOW64.
         if self.get_is_wow64():
-            peb32 = self.get_wow_64_process()
+            proc = self.get_wow_64_process()
         else:
             return None
         # Confirm WoW64Process points to a valid process address
-        if not proc_layer.is_valid(peb32):
+        if not proc_layer.is_valid(proc):
             raise exceptions.InvalidAddressException(
-                proc_layer_name, peb32, f"Invalid Wow64Process address at {self.Peb:0x}"
+                proc_layer_name, proc, f"Invalid Wow64Process address at {self.Peb:0x}"
             )
 
         # Leverage the context of existing symbol table to help configure
@@ -785,50 +785,41 @@ def get_peb32(self) -> interfaces.objects.ObjectInterface:
         if self._context.symbol_space.has_type(
             sym_table + constants.BANG + "_EWOW64PROCESS"
         ):
-            peb32 = self._context.object(
-                f"{self._32bit_table_name}{constants.BANG}_PEB32",
-                layer_name=proc_layer_name,
-                offset=peb32.Peb,
-            )
-            return peb32
+            offset=proc.Peb
 
         # vista sp0-sp1 and 2003 sp1-sp2
         elif self._context.symbol_space.has_type(
             sym_table + constants.BANG + "_WOW64_PROCESS"
         ):
-            peb32 = self._context.object(
-                f"{self._32bit_table_name}{constants.BANG}_PEB32",
-                layer_name=proc_layer_name,
-                offset=peb32.Wow64,
-            )
-            return peb32
+            offset=proc.Wow64
 
         else:
-            peb32 = self._context.object(
-                f"{self._32bit_table_name}{constants.BANG}_PEB32",
-                layer_name=proc_layer_name,
-                offset=peb32,
-            )
-            return peb32
+            offset=proc
+        
+        peb32 = self._context.object(
+            f"{self._32bit_table_name}{constants.BANG}_PEB32",
+            layer_name=proc_layer_name,
+            offset=offset,
+        )
+        return peb32
 
     def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Generator for DLLs in the order that they were loaded."""
         try:
             pebs = [
-                [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
-                [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
+                self.get_peb(), self.get_peb32(),
             ]
-            for peb, table_name in pebs:
-                if peb != None:
+            for peb in pebs:
+                if peb:
                     sym_table = self.get_symbol_table_name()
                     if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        Ldr_data = self._context.symbol_space.get_type(
+                        ldr_data = self._context.symbol_space.get_type(
                             self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
                         )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
+                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
                         sym_table = self._32bit_table_name
                     for entry in peb.Ldr.InLoadOrderModuleList.to_list(
-                        f"{sym_table}{constants.BANG}" + table_name,
+                        f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", 
                         "InLoadOrderLinks",
                     ):
                         yield entry
@@ -840,20 +831,19 @@ def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
 
         try:
             pebs = [
-                [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
-                [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
+                self.get_peb(), self.get_peb32(),
             ]
-            for peb, table_name in pebs:
-                if peb != None:
+            for peb in pebs:
+                if peb:
                     sym_table = self.get_symbol_table_name()
                     if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        Ldr_data = self._context.symbol_space.get_type(
+                        ldr_data = self._context.symbol_space.get_type(
                             self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
                         )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
+                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
                         sym_table = self._32bit_table_name
                     for entry in peb.Ldr.InInitializationOrderModuleList.to_list(
-                        f"{sym_table}{constants.BANG}" + table_name,
+                        f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
                         "InInitializationOrderLinks",
                     ):
                         yield entry
@@ -864,20 +854,19 @@ def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Generator for DLLs in the order that they appear in memory"""
         try:
             pebs = [
-                [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"],
-                [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"],
+                self.get_peb(), self.get_peb32(),
             ]
-            for peb, table_name in pebs:
-                if peb != None:
+            for peb in pebs:
+                if peb:
                     sym_table = self.get_symbol_table_name()
                     if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        Ldr_data = self._context.symbol_space.get_type(
+                        ldr_data = self._context.symbol_space.get_type(
                             self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
                         )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data)
+                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
                         sym_table = self._32bit_table_name
                     for entry in peb.Ldr.InMemoryOrderModuleList.to_list(
-                        f"{sym_table}{constants.BANG}" + table_name,
+                        f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
                         "InMemoryOrderLinks",
                     ):
                         yield entry