diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 25914842d..d09536868 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -87,11 +87,11 @@ class Handles(interfaces.plugins.PluginInterface): # is this the right thing to raise here? if magic is None: - if not has_capstone: + if has_capstone: raise AttributeError("Unable to find the SAR value for decoding handle table pointers") else: raise exceptions.MissingModuleException( - "capstone", "Unable to find the SAR value for decoding handle table pointers") + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset))