Updates to address the dlllist wow64 upgrades

Author: hsarkey

volatility3/framework/symbols/windows/extensions/__init__.py

@@ -776,7 +776,7 @@ def get_peb(self) -> interfaces.objects.ObjectInterface:
         )
         return peb
 
-    def get_peb32(self) -> interfaces.objects.ObjectInterface:
+    def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]:
         """Constructs a PEB32 object"""
         if constants.BANG not in self.vol.type_name:
             raise ValueError(
@@ -834,6 +834,14 @@ def get_peb32(self) -> interfaces.objects.ObjectInterface:
         )
         return peb32
 
+    def set_types(self, peb) -> str:
+        ldr_data = self._context.symbol_space.get_type(
+            self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
+        )
+        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
+        sym_table = self._32bit_table_name
+        return sym_table
+
     def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Generator for DLLs in the order that they were loaded."""
         try:
@@ -844,12 +852,10 @@ def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
             for peb in pebs:
                 if peb:
                     sym_table = self.get_symbol_table_name()
-                    if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        ldr_data = self._context.symbol_space.get_type(
-                            self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
-                        )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
-                        sym_table = self._32bit_table_name
+                    if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
+                        "unsigned long"
+                    ):
+                        sym_table = self.set_types(peb)
                     yield from peb.Ldr.InLoadOrderModuleList.to_list(
                         f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
                         "InLoadOrderLinks",
@@ -868,12 +874,10 @@ def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
             for peb in pebs:
                 if peb:
                     sym_table = self.get_symbol_table_name()
-                    if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        ldr_data = self._context.symbol_space.get_type(
-                            self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
-                        )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
-                        sym_table = self._32bit_table_name
+                    if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
+                        "unsigned long"
+                    ):
+                        sym_table = self.set_types(peb)
                     yield from peb.Ldr.InInitializationOrderModuleList.to_list(
                         f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
                         "InInitializationOrderLinks",
@@ -891,12 +895,10 @@ def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]:
             for peb in pebs:
                 if peb:
                     sym_table = self.get_symbol_table_name()
-                    if peb.Ldr.vol.type_name.endswith("unsigned long"):
-                        ldr_data = self._context.symbol_space.get_type(
-                            self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA"
-                        )
-                        peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data)
-                        sym_table = self._32bit_table_name
+                    if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == (
+                        "unsigned long"
+                    ):
+                        sym_table = self.set_types(peb)
                     yield from peb.Ldr.InMemoryOrderModuleList.to_list(
                         f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY",
                         "InMemoryOrderLinks",