diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 7b644eccf..d436bbcb9 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -255,22 +255,28 @@ You can try using ffmpeg to decode the raw buffer. Example usage: vollog.error( "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml." ) - return None + return kernel_name = self.config["kernel"] kernel = self.context.modules[kernel_name] if not kernel.has_symbol("num_registered_fb"): - raise exceptions.SymbolError( - "num_registered_fb", - kernel.symbol_table_name, - "The provided symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.", + vollog.error( + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' ) + return + + try: + num_registered_fb = kernel.object_from_symbol("num_registered_fb") + except exceptions.SymbolError: + vollog.error( + 'Creating an object from "num_registered_fb" caused a symbol error. This is a sign that the symbol table is outdated. Please re-generate your symbol table using the latest dwarf2json' + ) + return - num_registered_fb = kernel.object_from_symbol("num_registered_fb") if num_registered_fb < 1: vollog.info("No registered framebuffer in the fbdev API.") - return None + return registered_fb = kernel.object_from_symbol("registered_fb") fb_info_list = utility.array_of_pointers(