From 17efe7dbdc25657ae5e7084ec22ceb29e2cdc8da Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 5 Sep 2021 12:48:32 +0100 Subject: [PATCH] Windows: Fix issue #385 --- volatility3/framework/plugins/windows/dlllist.py | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 992d9538e..812586276 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -137,11 +137,21 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): file_handle.close() file_output = file_handle.preferred_filename + try: + dllbase = format_hints.Hex(entry.DllBase) + except exceptions.InvalidAddressException: + dllbase = renderers.NotAvailableValue() + + try: + size_of_image = format_hints.Hex(entry.SizeOfImage) + except exceptions.InvalidAddressException: + size_of_image = renderers.NotAvailableValue() + yield (0, (proc.UniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, - errors = 'replace'), format_hints.Hex(entry.DllBase), - format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName, DllLoadTime, file_output)) + errors = 'replace'), dllbase, size_of_image, BaseDllName, + FullDllName, DllLoadTime, file_output)) def generate_timeline(self): kernel = self.context.modules[self.config['kernel']]