From c6841586ccbba2f3f69a72e2edaff81e0a3c3891 Mon Sep 17 00:00:00 2001
From: Michael Ligh <mligh@volexity.com>
Date: Thu, 12 May 2016 16:44:18 -0700
Subject: [PATCH] the --fix parameter to PE dumping plugins was broken on wow64

explicitly define _IMAGE_OPTIONAL_HEADER32 so we can apply it to 32-bit
PE files when running under 64-bit windows
---
 .../plugins/overlays/windows/pe_vtypes.py     | 47 ++++++++++++++++++-
 1 file changed, 45 insertions(+), 2 deletions(-)

diff --git a/volatility/plugins/overlays/windows/pe_vtypes.py b/volatility/plugins/overlays/windows/pe_vtypes.py
index 85f62466..879e12c5 100644
--- a/volatility/plugins/overlays/windows/pe_vtypes.py
+++ b/volatility/plugins/overlays/windows/pe_vtypes.py
@@ -127,6 +127,40 @@ pe_vtypes = {
       'FileSubType': [0x28, ['unsigned long']],
       'FileDate': [0x2C, ['WinTimeStamp']],
     } ],
+    
+  '_IMAGE_OPTIONAL_HEADER32' : [ 0xe0, {
+    'Magic' : [ 0x0, ['unsigned short']],
+    'MajorLinkerVersion' : [ 0x2, ['unsigned char']],
+    'MinorLinkerVersion' : [ 0x3, ['unsigned char']],
+    'SizeOfCode' : [ 0x4, ['unsigned long']],
+    'SizeOfInitializedData' : [ 0x8, ['unsigned long']],
+    'SizeOfUninitializedData' : [ 0xc, ['unsigned long']],
+    'AddressOfEntryPoint' : [ 0x10, ['unsigned long']],
+    'BaseOfCode' : [ 0x14, ['unsigned long']],
+    'BaseOfData' : [ 0x18, ['unsigned long']],
+    'ImageBase' : [ 0x1c, ['unsigned long']],
+    'SectionAlignment' : [ 0x20, ['unsigned long']],
+    'FileAlignment' : [ 0x24, ['unsigned long']],
+    'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']],
+    'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']],
+    'MajorImageVersion' : [ 0x2c, ['unsigned short']],
+    'MinorImageVersion' : [ 0x2e, ['unsigned short']],
+    'MajorSubsystemVersion' : [ 0x30, ['unsigned short']],
+    'MinorSubsystemVersion' : [ 0x32, ['unsigned short']],
+    'Win32VersionValue' : [ 0x34, ['unsigned long']],
+    'SizeOfImage' : [ 0x38, ['unsigned long']],
+    'SizeOfHeaders' : [ 0x3c, ['unsigned long']],
+    'CheckSum' : [ 0x40, ['unsigned long']],
+    'Subsystem' : [ 0x44, ['unsigned short']],
+    'DllCharacteristics' : [ 0x46, ['unsigned short']],
+    'SizeOfStackReserve' : [ 0x48, ['unsigned long']],
+    'SizeOfStackCommit' : [ 0x4c, ['unsigned long']],
+    'SizeOfHeapReserve' : [ 0x50, ['unsigned long']],
+    'SizeOfHeapCommit' : [ 0x54, ['unsigned long']],
+    'LoaderFlags' : [ 0x58, ['unsigned long']],
+    'NumberOfRvaAndSizes' : [ 0x5c, ['unsigned long']],
+    'DataDirectory' : [ 0x60, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]],
+    } ],
 }
 
 pe_vtypes_64 = {
@@ -163,6 +197,9 @@ resource_types = {
      'RT_HTML'         : 23,
 }
 
+IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b
+IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
+
 class _IMAGE_EXPORT_DIRECTORY(obj.CType):
     """Class for PE export directory"""
 
@@ -652,8 +689,14 @@ class _IMAGE_DOS_HEADER(obj.CType):
         provided base address
         """        
 
-        imb_offs = nt_header.OptionalHeader.ImageBase.obj_offset - self.obj_offset      
-        imb = nt_header.OptionalHeader.ImageBase
+        opthdr = nt_header.OptionalHeader
+        
+        if opthdr.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC:
+            if opthdr.obj_vm.profile.metadata.get("memory_model") == "64bit":
+                opthdr = opthdr.cast("_IMAGE_OPTIONAL_HEADER32")
+        
+        imb_offs = opthdr.ImageBase.obj_offset - self.obj_offset      
+        imb = opthdr.ImageBase
         newval = struct.pack(imb.format_string, int(self.obj_offset))
         return header[:imb_offs] + newval + header[imb_offs+imb.size():]