From 4c937a922d92175135e64be2192b94e8a232c4df Mon Sep 17 00:00:00 2001 From: atcuno Date: Thu, 9 May 2024 14:47:56 -0500 Subject: [PATCH] Correctly check for a failed read --- volatility3/framework/plugins/windows/handles.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index d43d26ef1..93ca37c6b 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -161,8 +161,9 @@ class Handles(interfaces.plugins.PluginInterface): except exceptions.SymbolError: return None - data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200) - if data is None: + try: + data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200) + except exceptions.InvalidAddressException: return None md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)