From 4c7f2a3762317b3adeac0877795cbe4e7acdf910 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 3 Jan 2020 12:16:17 -0600 Subject: [PATCH] catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) --- .../symbols/windows/extensions/__init__.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 10e64dc5d..f06c40f94 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -101,11 +101,17 @@ class MMVAD_SHORT(objects.StructType): vad_object = self.cast(target) yield vad_object - for vad_node in self.get_left_child().dereference().traverse(visited, depth + 1): - yield vad_node + try: + for vad_node in self.get_left_child().dereference().traverse(visited, depth + 1): + yield vad_node + except exceptions.InvalidAddressException as excp: + vollog.log(constants.LOGLEVEL_VVV, "Invalid address on LeftChild: {0:#x}".format(excp.invalid_address)) - for vad_node in self.get_right_child().dereference().traverse(visited, depth + 1): - yield vad_node + try: + for vad_node in self.get_right_child().dereference().traverse(visited, depth + 1): + yield vad_node + except exceptions.InvalidAddressException as excp: + vollog.log(constants.LOGLEVEL_VVV, "Invalid address on RightChild: {0:#x}".format(excp.invalid_address)) def get_right_child(self): """Get the right child member."""