From 3545ab7746dfe868901da229925323cc1dc77d48 Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Wed, 30 Oct 2019 06:24:08 -0400 Subject: [PATCH] Fixes on pydoc, types, exception catching --- .../symbols/windows/extensions/__init__.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index b7887bc26..913acf598 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -740,7 +740,10 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) - proc_layer_name = self.add_process_layer() + try: + proc_layer_name = self.add_process_layer() + except exceptions.InvalidAddressException: + return proc_layer = self._context.layers[proc_layer_name] if not proc_layer.is_valid(self.Peb): @@ -752,7 +755,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): offset = self.Peb) return peb - def load_order_modules(self) -> Iterable[int]: + def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" peb = self.get_peb() @@ -760,16 +763,16 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InLoadOrderLinks"): yield entry - def init_order_modules(self) -> Iterable[int]: - """Generator for DLLs in the order that they were loaded.""" + def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Generator for DLLs in the order that they were initialized""" peb = self.get_peb() for entry in peb.Ldr.InInitializationOrderModuleList.to_list( "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InInitializationOrderLinks"): yield entry - def mem_order_modules(self) -> Iterable[int]: - """Generator for DLLs in the order that they were loaded.""" + def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Generator for DLLs in the order that they appear in memory""" peb = self.get_peb() for entry in peb.Ldr.InMemoryOrderModuleList.to_list(