diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 109a21d4b..a883f4379 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -31,8 +31,10 @@ class CmdLine(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - # TODO: what kind of exceptions could this raise and what should we do? - proc_layer_name = proc.add_process_layer() + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue try: peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB", diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 1218bb972..38484556c 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -53,8 +53,11 @@ class DllDump(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - # TODO: what kind of exceptions could this raise and what should we do? - proc_layer_name = proc.add_process_layer() + + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 1e240fbe4..d6e2d1eb0 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -73,8 +73,11 @@ class Malfind(interfaces.plugins.PluginInterface): Returns: An iterable of VAD instances and the first 64 bytes of data containing in that region """ + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + return - proc_layer_name = proc.add_process_layer() proc_layer = context.layers[proc_layer_name] for vad in proc.get_vad_root().traverse(): diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 5c4f6be6b..32564ceb4 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -60,7 +60,10 @@ class ModDump(interfaces.plugins.PluginInterface): layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func): - proc_layer_name = proc.add_process_layer() + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue try: # create the session space object in the process' own layer. diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 5ba39601e..0ac09b1ab 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -42,8 +42,11 @@ class ProcDump(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - # TODO: what kind of exceptions could this raise and what should we do? - proc_layer_name = proc.add_process_layer() + + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue try: peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB", diff --git a/volatility/framework/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py index 2e65ed360..696b0489f 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility/framework/plugins/windows/strings.py @@ -95,7 +95,11 @@ class Strings(interfaces.plugins.PluginInterface): for process in pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols']): - proc_layer_name = process.add_process_layer() + try: + proc_layer_name = process.add_process_layer() + except exceptions.InvalidAddressException: + continue + proc_layer = self.context.layers[proc_layer_name] if isinstance(proc_layer, linear.LinearlyMappedLayer): for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index 136cb41b7..554c5b0a2 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -131,7 +131,11 @@ class SvcScan(interfaces.plugins.PluginInterface): symbol_table = self.config['nt_symbols'], filter_func = filter_func): - proc_layer_name = task.add_process_layer() + try: + proc_layer_name = task.add_process_layer() + except exceptions.InvalidAddressException: + continue + layer = self.context.layers[proc_layer_name] for offset in layer.scan(context = self.context, diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 4ca5483d3..3d96d42b7 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -47,8 +47,11 @@ class VadDump(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - # TODO: what kind of exceptions could this raise and what should we do? - proc_layer_name = proc.add_process_layer() + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue + proc_layer = self.context.layers[proc_layer_name] for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): @@ -58,6 +61,7 @@ class VadDump(interfaces.plugins.PluginInterface): offset = vad.get_start() out_of_range = vad.get_start() + vad.get_end() + print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset)) while offset < out_of_range: to_read = min(chunk_size, out_of_range - offset) data = proc_layer.read(offset, to_read, pad = True) diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index 3ccdcd1cb..52b391003 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -123,7 +123,11 @@ class VerInfo(interfaces.plugins.PluginInterface): # now go through the process and dll lists for proc in procs: - proc_layer_name = proc.add_process_layer() + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue + for entry in proc.load_order_modules(): try: