diff --git a/samples/um/ldr.py b/samples/um/ldr.py index 7985b55..9dbde89 100644 --- a/samples/um/ldr.py +++ b/samples/um/ldr.py @@ -9,7 +9,7 @@ def listModuleFromLdr64(): peb = typedVar( "ntdll!PEB", getCurrentProcess() ) - moduleLst = typedVarList( peb.Ldr.deref().InLoadOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) + moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) for mod in moduleLst: name = typedVar( "ntdll!_UNICODE_STRING", mod.BaseDllName ) @@ -21,7 +21,7 @@ def listModuleFromLdr64(): dprintln( "\n32 bit modules:", True) - moduleLst = typedVarList( peb32.Ldr.deref().InLoadOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) + moduleLst = typedVarList( peb32.Ldr.deref().InMemoryOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) for mod in moduleLst: name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName ) @@ -34,7 +34,7 @@ def listModuleFromLdr(): peb = typedVar( "ntdll!PEB", getCurrentProcess() ) - moduleLst = typedVarList( peb.Ldr.deref().InLoadOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) + moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) for mod in moduleLst: dprintln(loadUnicodeString(mod.BaseDllName))