From 30eec0cb761b73d3723a7928ec8a1774f75e9b7a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 30 Jul 2021 00:17:26 +0100 Subject: [PATCH] Windows: Ensure the kernel contains an actual kvo --- volatility3/framework/automagic/pdbscan.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 474146ad1..fe6e463e0 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -124,10 +124,11 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if valid_kernel: # Set the virtual offset under the TranslationLayer it applies to virtual_layer, kvo, kernel = valid_kernel - kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path, - 'kernel_virtual_offset') - context.config[kvo_path] = kvo - vollog.debug(f"Setting kernel_virtual_offset to {hex(kvo)}") + if kvo is not None: + kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path, + 'kernel_virtual_offset') + context.config[kvo_path] = kvo + vollog.debug(f"Setting kernel_virtual_offset to {hex(kvo)}") def get_physical_layer_name(self, context, vlayer): return context.config.get(interfaces.configuration.path_join(vlayer.config_path, 'memory_layer'), None)