mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
ShimcacheMem: Fix exc getting module name
`module.BaseDll.String` can raise an `InvalidAddressException`, this catches it and continues through the loop.
This commit is contained in:
@@ -582,13 +582,19 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
|
||||
:return: The offset and size of the module, if found; Otherwise, returns `None`
|
||||
"""
|
||||
|
||||
try:
|
||||
krnl_mod = next(
|
||||
module
|
||||
for module in modules.Modules.list_modules(context, kernel_module_name)
|
||||
if module.BaseDllName.String in module_list
|
||||
)
|
||||
except StopIteration:
|
||||
krnl_mod = None
|
||||
for module in modules.Modules.list_modules(context, kernel_module_name):
|
||||
try:
|
||||
if module.BaseDllName.String in module_list:
|
||||
krnl_mod = module
|
||||
break
|
||||
except exceptions.InvalidAddressException as exc:
|
||||
vollog.warning(
|
||||
f"Failed to get kernel module due to {exc.__class__.__name__}: {exc.invalid_address:#x}"
|
||||
)
|
||||
|
||||
if krnl_mod is None:
|
||||
vollog.warning("Failed to find kernel module")
|
||||
return None
|
||||
|
||||
kernel = context.modules[kernel_module_name]
|
||||
|
||||
Reference in New Issue
Block a user