WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Handle bad unix timestamps.

Browse Source
This commit is contained in:
Mike Auty
2018-04-11 15:39:32 +01:00
parent 1f733e7dc4
commit 133eb916cf
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/objects/utility.py
+6 -2
View File
@@ -42,9 +42,13 @@ def array_of_pointers(array: objects.Array,
return array.cast("array", count = count, subtype = subtype_pointer)
def wintime_to_datetime(wintime: objects.Struct) -> typing.Union[renderers.NotApplicableValue, datetime.datetime]:
def wintime_to_datetime(wintime: objects.Struct) -> typing.Union[
interfaces.renderers.BaseAbsentValue, datetime.datetime]:
unix_time = wintime.QuadPart // 10000000
if unix_time == 0:
return renderers.NotApplicableValue()
unix_time = unix_time - 11644473600
return datetime.datetime.utcfromtimestamp(unix_time)
try:
return datetime.datetime.utcfromtimestamp(unix_time)
except ValueError:
return renderers.UnparsableValue()