From 1a80dbf9353f94d4bf44902b041f1b34557915ed Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 10 Mar 2018 21:43:46 +0000 Subject: [PATCH] Change Unparsable to NotApplicable for situations we expect. --- volatility/framework/symbols/windows/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index e60ed41b4..f67ea1395 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -189,7 +189,7 @@ class _EPROCESS(generic.GenericIntelProcess): try: if hasattr(self, "Session"): if self.Session == 0: - return renderers.UnparsableValue() + return renderers.NotApplicableValue() layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table().name @@ -209,14 +209,14 @@ class _EPROCESS(generic.GenericIntelProcess): def get_create_time(self): unix_time = self.CreateTime.QuadPart // 10000000 if unix_time == 0: - return renderers.UnparsableValue() + return renderers.NotApplicableValue() unix_time = unix_time - 11644473600 return str(datetime.datetime.utcfromtimestamp(unix_time)) def get_exit_time(self): unix_time = self.ExitTime.QuadPart // 10000000 if unix_time == 0: - return renderers.UnparsableValue() + return renderers.NotApplicableValue() unix_time = unix_time - 11644473600 return str(datetime.datetime.utcfromtimestamp(unix_time))