From 24a53b4f68e0e219907840b28ae094fa0cf8498c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:22:07 +0000 Subject: [PATCH] Prevent truecrypt from throwing a backtrace when the module isn't found and print a warning --- .../framework/plugins/windows/truecrypt.py | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index 158fc995d..aaab49d20 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -2,6 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging + from typing import Iterable, Generator, List, Tuple from volatility3.framework import constants, interfaces, renderers @@ -17,6 +19,8 @@ from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import modules +vollog = logging.getLogger(__name__) + class Passphrase(interfaces.plugins.PluginInterface): """TrueCrypt Cached Passphrase Finder""" @@ -123,11 +127,18 @@ class Passphrase(interfaces.plugins.PluginInterface): mods: Iterable[ObjectInterface] = modules.Modules.list_modules( self.context, self.config["kernel"] ) - truecrypt_module_base = next( - mod.DllBase - for mod in mods - if mod.BaseDllName.get_string().lower() == "truecrypt.sys" - ) + try: + truecrypt_module_base = next( + mod.DllBase + for mod in mods + if mod.BaseDllName.get_string().lower() == "truecrypt.sys" + ) + except StopIteration: + vollog.warning( + "Truecrypt module not found in the modules list. Unable to proceed." + ) + return + for offset, password in self.scan_module( truecrypt_module_base, kernel.layer_name ):