From 3c6121bc771cb9a4cfe1a5e07c9d1c6c9d2600de Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 7 Mar 2018 12:43:06 -0600 Subject: [PATCH] raise AttributeError in helper_wow_64_process() --- .../framework/symbols/windows/extensions/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 4845f3099..bb83a6194 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -229,13 +229,19 @@ class _EPROCESS(generic.GenericIntelProcess): def helper_wow_64_process(self): if hasattr(self, "Wow64Process"): return self.Wow64Process + elif hasattr(self, "WoW64Process"): return self.WoW64Process - return None + + raise AttributeError("Unable to find Wow64Process") @property def helper_is_wow64(self): - value = self.helper_wow_64_process + try: + value = self.helper_wow_64_process + except AttributeError: + return False + return value != 0 and value != None class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):