From 30be4ee2ecc8b81ac98efecd43532527e13eba47 Mon Sep 17 00:00:00 2001
From: memoryforensics1 <61626429+memoryforensics1@users.noreply.github.com>
Date: Tue, 22 Sep 2020 20:24:25 +0300
Subject: [PATCH] fix get_sids function

fix get_sids function in broken images
---
 .../symbols/windows/extensions/__init__.py    | 37 ++++++++++---------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py
index d77e0ccdb..eb55fb5c6 100644
--- a/volatility/framework/symbols/windows/extensions/__init__.py
+++ b/volatility/framework/symbols/windows/extensions/__init__.py
@@ -768,23 +768,26 @@ class TOKEN(objects.StructType):
                                             subtype = ntkrnlmp.get_type("_SID_AND_ATTRIBUTES"),
                                             count=self.UserAndGroupCount)
             for sid_and_attr in UserAndGroups:
-                sid = sid_and_attr.Sid.dereference().cast("_SID")
-                 # catch invalid pointers (UserAndGroupCount is too high)
-                if sid is None:
-                    return
-                # this mimics the windows API IsValidSid
-                if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15:
-                    return
-                id_auth = ""
-                for i in sid.IdentifierAuthority.Value:
-                    id_auth = i
-                SubAuthority = ntkrnlmp.object(object_type="array",
-                                               offset=sid.SubAuthority.vol.offset - kvo,
-                                               subtype = ntkrnlmp.get_type("unsigned long"),
-                                               count= int(sid.SubAuthorityCount))
-                yield "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) +
-                                      tuple(SubAuthority))
-            
+                try:
+                    sid = sid_and_attr.Sid.dereference().cast("_SID")
+                     # catch invalid pointers (UserAndGroupCount is too high)
+                    if sid is None:
+                        return
+                    # this mimics the windows API IsValidSid
+                    if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15:
+                        return
+                    id_auth = ""
+                    for i in sid.IdentifierAuthority.Value:
+                        id_auth = i
+                    SubAuthority = ntkrnlmp.object(object_type="array",
+                                                   offset=sid.SubAuthority.vol.offset - kvo,
+                                                   subtype = ntkrnlmp.get_type("unsigned long"),
+                                                   count= int(sid.SubAuthorityCount))
+                    yield "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) +
+                                          tuple(SubAuthority))
+                except exceptions.InvalidAddressException:
+                    pass
+
 
     def privileges(self):
         "Return a list of privileges for the current token object."