WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 17:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1217 from eve-mem/windows_issue_1146

Browse Source 
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
This commit is contained in:
ikelos
2024-07-30 22:38:36 +01:00
committed by GitHub
parent bee333908b 799afe6e51
commit 4e8d64ed86
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/handles.py
+2 -2
View File
@@ -177,7 +177,7 @@ class Handles(interfaces.plugins.PluginInterface):
)
except exceptions.InvalidAddressException:
vollog.warning(
f"Failed to read {hex(num_bytes_to_read)} bytes at symbol {hex(func_addr_to_read)}. Unable to decode SAR value. Failing back to a common value of 0x10"
f"Failed to read {hex(num_bytes_to_read)} bytes at symbol {hex(func_addr_to_read)}. Unable to decode SAR value. Failing back to a common value of {hex(DEFAULT_SAR_VALUE)}"
)
self._sar_value = DEFAULT_SAR_VALUE
return self._sar_value
@@ -201,7 +201,7 @@ class Handles(interfaces.plugins.PluginInterface):
if self._sar_value is None:
vollog.warning(
f"Failed to to locate SAR value having parsed {instruction_count} instructions, failing back to a common value of 0x10"
f"Failed to to locate SAR value having parsed {instruction_count} instructions, failing back to a common value of {hex(DEFAULT_SAR_VALUE)}"
)
self._sar_value = DEFAULT_SAR_VALUE