diff --git a/samples/um/ldr.py b/samples/um/ldr.py index ffa4f2b..7985b55 100644 --- a/samples/um/ldr.py +++ b/samples/um/ldr.py @@ -15,15 +15,20 @@ def listModuleFromLdr64(): name = typedVar( "ntdll!_UNICODE_STRING", mod.BaseDllName ) dprintln(loadWChars(name.Buffer, name.Length/2)) - dprintln( "\n32 bit modules:", True) + try: + + peb32 = typedVar( "ntdll32!_PEB", getCurrentProcess() - pageSize() ) - peb32 = typedVar( "ntdll32!_PEB", getCurrentProcess() - pageSize() ) + dprintln( "\n32 bit modules:", True) - moduleLst = typedVarList( peb32.Ldr.deref().InLoadOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) + moduleLst = typedVarList( peb32.Ldr.deref().InLoadOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) - for mod in moduleLst: - name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName ) - dprintln(loadWChars(name.Buffer, name.Length/2)) + for mod in moduleLst: + name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName ) + dprintln(loadWChars(name.Buffer, name.Length/2)) + + except BaseException: + pass def listModuleFromLdr():