From 1c2a9921ff9d336368c6d92afd3656c6b4bcbe3e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Dec 2020 15:21:06 +0000 Subject: [PATCH] Windows: Partial fix for #368 error messages --- volatility/framework/plugins/windows/handles.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 25914842d..d09536868 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -87,11 +87,11 @@ class Handles(interfaces.plugins.PluginInterface): # is this the right thing to raise here? if magic is None: - if not has_capstone: + if has_capstone: raise AttributeError("Unable to find the SAR value for decoding handle table pointers") else: raise exceptions.MissingModuleException( - "capstone", "Unable to find the SAR value for decoding handle table pointers") + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset))