Prevent truecrypt from throwing a backtrace when the module isn't found and print a warning

This commit is contained in:
Andrew Case
2025-03-08 00:22:07 +00:00
parent 0b6203cf7a
commit 24a53b4f68
@@ -2,6 +2,8 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import Iterable, Generator, List, Tuple
from volatility3.framework import constants, interfaces, renderers
@@ -17,6 +19,8 @@ from volatility3.framework.symbols.windows.extensions import pe
from volatility3.plugins.windows import modules
vollog = logging.getLogger(__name__)
class Passphrase(interfaces.plugins.PluginInterface):
"""TrueCrypt Cached Passphrase Finder"""
@@ -123,11 +127,18 @@ class Passphrase(interfaces.plugins.PluginInterface):
mods: Iterable[ObjectInterface] = modules.Modules.list_modules(
self.context, self.config["kernel"]
)
truecrypt_module_base = next(
mod.DllBase
for mod in mods
if mod.BaseDllName.get_string().lower() == "truecrypt.sys"
)
try:
truecrypt_module_base = next(
mod.DllBase
for mod in mods
if mod.BaseDllName.get_string().lower() == "truecrypt.sys"
)
except StopIteration:
vollog.warning(
"Truecrypt module not found in the modules list. Unable to proceed."
)
return
for offset, password in self.scan_module(
truecrypt_module_base, kernel.layer_name
):