diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py index 67bfcfbbf..add654795 100644 --- a/volatility3/framework/plugins/windows/devicetree.py +++ b/volatility3/framework/plugins/windows/devicetree.py @@ -77,7 +77,7 @@ vollog = logging.getLogger(__name__) class DeviceTree(interfaces.plugins.PluginInterface): """Listing tree based on drivers and attached devices in a particular windows memory image.""" - _required_framework_version = (2, 0, 1) + _required_framework_version = (2, 0, 3) _version = (1, 0, 0) @classmethod @@ -121,8 +121,7 @@ class DeviceTree(interfaces.plugins.PluginInterface): for level, attached_device in enumerate(device.get_attached_devices(), start=2): device_name = attached_device.get_device_name() - attached_device_name = "Unparsable Value" if isinstance(device_name, renderers.UnparsableValue) else device_name - name = "{} - {}".format(attached_device_name, attached_device.DriverObject.DriverName.get_string()) + name = "{} - {}".format(device_name, attached_device.DriverObject.DriverName.get_string()) attached_device_type = DEVICE_CODES.get(attached_device.DeviceType, "UNKNOWN") diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 2266305fa..b7b53f6e9 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -352,13 +352,10 @@ class EX_FAST_REF(objects.StructType): class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel device objects.""" - def get_device_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: + def get_device_name(self) -> str: """Get device's name from the object header.""" - try: - header = self.get_object_header() - return header.NameInfo.Name.String # type: ignore - except(ValueError): - return renderers.UnparsableValue() + header = self.get_object_header() + return header.NameInfo.Name.String # type: ignore def get_attached_devices(self) -> Generator[ObjectInterface, None, None]: """Enumerate the device's attaches""" @@ -370,13 +367,10 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel driver objects.""" - def get_driver_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: + def get_driver_name(self) -> str: """Get driver's name from the object header.""" - try: - header = self.get_object_header() - return header.NameInfo.Name.String # type: ignore - except(ValueError): - return renderers.UnparsableValue() + header = self.get_object_header() + return header.NameInfo.Name.String # type: ignore def get_devices(self) -> Generator[ObjectInterface, None, None]: """Enumerate the driver's device objects"""