From 00f3b4fb4448cd121d472effcaaf37f3e2a20375 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Tue, 21 Feb 2017 23:25:02 +0000
Subject: [PATCH] Remove the error checking in dlllist, we need to be throwing
 exceptions and handling them.

---
 .../symbols/windows/extensions/__init__.py    | 16 ++++++---
 volatility/plugins/windows/dlllist.py         | 36 ++++++++++++-------
 2 files changed, 34 insertions(+), 18 deletions(-)

diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py
index dbc31aaf6..19253c474 100644
--- a/volatility/framework/symbols/windows/extensions/__init__.py
+++ b/volatility/framework/symbols/windows/extensions/__init__.py
@@ -13,12 +13,16 @@ class _ETHREAD(objects.Struct):
         """Return the EPROCESS that owns this thread"""
         return self.ThreadsProcess.dereference(kernel_layer)
 
+
 class _UNICODE_STRING(objects.Struct):
     @property
     def String(self):
-        if not self._context.memory[self.vol.layer_name].is_valid(self.Buffer):
-            return ""
-        return self.Buffer.dereference().cast("string", max_length = self.Length, errors = "replace", encoding = "utf16")
+        # We explicitly do *not* catch errors here, we allow an exception to be thrown
+        # (otherwise there's no way to determine anything went wrong)
+        # It's up to the user of this method to catch exceptions
+        return self.Buffer.dereference().cast("string", max_length = self.Length, errors = "replace",
+                                              encoding = "utf16")
+
 
 class _EPROCESS(objects.Struct):
     def add_process_layer(self, context, config_prefix = None, preferred_name = None):
@@ -66,14 +70,16 @@ class _EPROCESS(objects.Struct):
 
         proc_layer = self._context.memory[proc_layer_name]
         if not proc_layer.is_valid(self.Peb):
-            raise StopIteration 
+            raise StopIteration
 
         sym_table = self.vol.type_name.split("!")[0]
         peb = self._context.object("{}!_PEB".format(sym_table), layer_name = proc_layer_name, offset = self.Peb)
 
-        for entry in peb.Ldr.InLoadOrderModuleList.to_list("{}!_LDR_DATA_TABLE_ENTRY".format(sym_table), "InLoadOrderLinks"):
+        for entry in peb.Ldr.InLoadOrderModuleList.to_list("{}!_LDR_DATA_TABLE_ENTRY".format(sym_table),
+                                                           "InLoadOrderLinks"):
             yield entry
 
+
 class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):
     def to_list(self, symbol_type, member, forward = True, sentinel = True, layer = None):
         """Returns an iterator of the entries in the list"""
diff --git a/volatility/plugins/windows/dlllist.py b/volatility/plugins/windows/dlllist.py
index 3e3cba436..6f300acb8 100644
--- a/volatility/plugins/windows/dlllist.py
+++ b/volatility/plugins/windows/dlllist.py
@@ -1,9 +1,11 @@
 import volatility.framework.interfaces.plugins as plugins
 import volatility.plugins.windows.pslist as pslist
-from volatility.framework.configuration import requirements
+from volatility.framework import exceptions
 from volatility.framework import renderers
+from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
 
+
 class DllList(plugins.PluginInterface):
     @classmethod
     def get_requirements(cls):
@@ -19,22 +21,30 @@ class DllList(plugins.PluginInterface):
 
         for proc in procs:
 
-            for entry in proc.load_order_modules(): 
+            for entry in proc.load_order_modules():
 
-                yield (0, (proc.UniqueProcessId, 
-                       proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
-                                               errors = 'replace'),
-                       format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage), 
-                       entry.BaseDllName.String, entry.FullDllName.String))
+                BaseDllName = FullDllName = ""
+                try:
+                    BaseDllName = entry.BaseDllName.String
+                    # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName
+                    FullDllName = entry.FullDllName.String
+                except exceptions.InvalidAddressException:
+                    pass
+
+                yield (0, (proc.UniqueProcessId,
+                           proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
+                                                   errors = 'replace'),
+                           format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage),
+                           BaseDllName, FullDllName))
 
     def run(self):
 
         plugin = pslist.PsList(self.context, "plugins.DllList")
 
         return renderers.TreeGrid([("PID", int),
-                         ("Process", str),
-                         ("Base", format_hints.Hex),
-                         ("Size", format_hints.Hex),
-                         ("Name", str), 
-                         ("Path", str)],
-                        self._generator(plugin.list_processes()))
+                                   ("Process", str),
+                                   ("Base", format_hints.Hex),
+                                   ("Size", format_hints.Hex),
+                                   ("Name", str),
+                                   ("Path", str)],
+                                  self._generator(plugin.list_processes()))