From 0d4075355a6fa16c982b7206bcfcd7132d9afad7 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 7 Oct 2020 13:48:06 -0500 Subject: [PATCH] refs #332 catch invalid address exceptions when reading DllBase --- volatility/framework/plugins/windows/verinfo.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index e0a4aa462..10896a480 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -139,6 +139,11 @@ class VerInfo(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: BaseDllName = renderers.UnreadableValue() + try: + DllBase = format_hints.Hex(entry.DllBase) + except exceptions.InvalidAddressException: + DllBase = renderers.UnreadableValue() + try: (major, minor, product, build) = self.get_version_information(self._context, pe_table_name, proc_layer_name, entry.DllBase) @@ -148,7 +153,9 @@ class VerInfo(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, - errors = "replace"), format_hints.Hex(entry.DllBase), BaseDllName, + errors = "replace"), + DllBase, + BaseDllName, major, minor, product, build)) def run(self):