diff --git a/volatility/plugins/windows/handles.py b/volatility/plugins/windows/handles.py index c4b610a91..0b652b85e 100644 --- a/volatility/plugins/windows/handles.py +++ b/volatility/plugins/windows/handles.py @@ -98,7 +98,7 @@ class Handles(interfaces_plugins.PluginInterface): try: func_addr = ntkrnlmp.get_symbol("ObpCaptureHandleInformationEx").address - except AttributeError: + except exceptions.SymbolError: return None data = self.context.memory.read(virtual_layer_name, kvo + func_addr, 0x200)