From e9a4ea1a9c4f9fe18571ec9734406f60de2c0b99 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 15:39:23 -0500 Subject: [PATCH 1/2] Fix traceback in volshell's `dt()` A `SymbolError` can occur when a type contains a pointer to an opaque type. For example, `_EPROCESS` can have a member that points to an `_EPROCESS_QUOTA_BLOCK`, but there is no definition for that type, so its size and readability can't be determined. This wraps the block in a try/except, and reports that the type has an unknown size in the suffix if a `SymbolError` occurs. --- volatility3/cli/volshell/generic.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 32a5bd933..7c85eec5f 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -621,12 +621,15 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(value, objects.Pointer): # show pointers in hex to match output for struct addrs # highlight null or unreadable pointers - if value == 0: - suffix = " (null pointer)" - elif not value.is_readable(): - suffix = " (unreadable pointer)" - else: - suffix = "" + try: + if value == 0: + suffix = " (null pointer)" + elif not value.is_readable(): + suffix = " (unreadable pointer)" + else: + suffix = "" + except exceptions.SymbolError as exc: + suffix = f" (pointer to {exc.symbol_name} - unknown size)" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value) From 195f4154e97c5134ee390f0cbe81e0eef156225c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 16:18:22 -0500 Subject: [PATCH 2/2] Shorten suffix --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7c85eec5f..2ea722a37 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -629,7 +629,7 @@ class Volshell(interfaces.plugins.PluginInterface): else: suffix = "" except exceptions.SymbolError as exc: - suffix = f" (pointer to {exc.symbol_name} - unknown size)" + suffix = f" (unknown sized {exc.symbol_name})" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value)