Windows - add missing add_process_layer exception handling in a few plugins

volatility/framework/plugins/windows/cmdline.py

@@ -31,8 +31,10 @@ class CmdLine(interfaces.plugins.PluginInterface):
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)
-            # TODO: what kind of exceptions could this raise and what should we do?
-            proc_layer_name = proc.add_process_layer()
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
 
             try:
                 peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB",

volatility/framework/plugins/windows/dlldump.py

@@ -53,8 +53,11 @@ class DllDump(interfaces.plugins.PluginInterface):
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)
-            # TODO: what kind of exceptions could this raise and what should we do?
-            proc_layer_name = proc.add_process_layer()
+            
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
 
             for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func):
 

volatility/framework/plugins/windows/malfind.py

@@ -73,8 +73,11 @@ class Malfind(interfaces.plugins.PluginInterface):
         Returns:
             An iterable of VAD instances and the first 64 bytes of data containing in that region
         """
+        try:
+            proc_layer_name = proc.add_process_layer()
+        except exceptions.InvalidAddressException:
+            return
 
-        proc_layer_name = proc.add_process_layer()
         proc_layer = context.layers[proc_layer_name]
 
         for vad in proc.get_vad_root().traverse():

volatility/framework/plugins/windows/moddump.py

@@ -60,7 +60,10 @@ class ModDump(interfaces.plugins.PluginInterface):
                                                  layer_name = layer_name,
                                                  symbol_table = symbol_table,
                                                  filter_func = filter_func):
-            proc_layer_name = proc.add_process_layer()
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
 
             try:
                 # create the session space object in the process' own layer.

volatility/framework/plugins/windows/procdump.py

@@ -42,8 +42,11 @@ class ProcDump(interfaces.plugins.PluginInterface):
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)
-            # TODO: what kind of exceptions could this raise and what should we do?
-            proc_layer_name = proc.add_process_layer()
+            
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
 
             try:
                 peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB",

volatility/framework/plugins/windows/strings.py

@@ -95,7 +95,11 @@ class Strings(interfaces.plugins.PluginInterface):
 
             for process in pslist.PsList.list_processes(self.context, self.config['primary'],
                                                         self.config['nt_symbols']):
-                proc_layer_name = process.add_process_layer()
+                try:
+                    proc_layer_name = process.add_process_layer()
+                except exceptions.InvalidAddressException:
+                    continue
+
                 proc_layer = self.context.layers[proc_layer_name]
                 if isinstance(proc_layer, linear.LinearlyMappedLayer):
                     for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):

volatility/framework/plugins/windows/svcscan.py

@@ -131,7 +131,11 @@ class SvcScan(interfaces.plugins.PluginInterface):
                                                  symbol_table = self.config['nt_symbols'],
                                                  filter_func = filter_func):
 
-            proc_layer_name = task.add_process_layer()
+            try:
+                proc_layer_name = task.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
+
             layer = self.context.layers[proc_layer_name]
 
             for offset in layer.scan(context = self.context,

volatility/framework/plugins/windows/vaddump.py

@@ -47,8 +47,11 @@ class VadDump(interfaces.plugins.PluginInterface):
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)
 
-            # TODO: what kind of exceptions could this raise and what should we do?
-            proc_layer_name = proc.add_process_layer()
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
+
             proc_layer = self.context.layers[proc_layer_name]
 
             for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func):
@@ -58,6 +61,7 @@ class VadDump(interfaces.plugins.PluginInterface):
 
                     offset = vad.get_start()
                     out_of_range = vad.get_start() + vad.get_end()
+                    print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset))
                     while offset < out_of_range:
                         to_read = min(chunk_size, out_of_range - offset)
                         data = proc_layer.read(offset, to_read, pad = True)

volatility/framework/plugins/windows/verinfo.py

@@ -123,7 +123,11 @@ class VerInfo(interfaces.plugins.PluginInterface):
 
         # now go through the process and dll lists
         for proc in procs:
-            proc_layer_name = proc.add_process_layer()
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue            
+
             for entry in proc.load_order_modules():
 
                 try: