WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 18:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1616 from volatilityfoundation/dgmcdona/windows_cmdline_output

Browse Source 
Windows Cmdline: Clean up output
This commit is contained in:
ikelos
2025-02-13 22:47:40 +00:00
committed by GitHub
parent 4172a574d5 bcbfc27d4f
commit 3f2a514cc2
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/cmdline.py
+13 -3
View File
@@ -70,6 +70,7 @@ class CmdLine(interfaces.plugins.PluginInterface):
for proc in procs:
process_name = utility.array_to_string(proc.ImageFileName)
proc_id = "Unknown"
result_text = None
try:
proc_id = proc.UniqueProcessId
@@ -78,13 +79,22 @@ class CmdLine(interfaces.plugins.PluginInterface):
)
except exceptions.SwappedInvalidAddressException as exp:
result_text = f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)"
vollog.debug(
f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)"
)
except exceptions.PagedInvalidAddressException as exp:
result_text = f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)"
vollog.debug(
f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)"
)
except exceptions.InvalidAddressException as exp:
result_text = f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)"
vollog.debug(
f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)"
)
if not result_text:
result_text = renderers.UnreadableValue()
yield (0, (proc.UniqueProcessId, process_name, result_text))