catch InvalidAddressException when creating RegistryHive

2026-09-07 02:07:39 +02:00 · 2019-09-17 16:59:50 +01:00
parent 2e4a8c7247
commit 508a9148ed
1 changed files with 5 additions and 1 deletions
@@ -76,7 +76,11 @@ class HiveList(plugins.PluginInterface):
                base_layer = layer_name,
                nt_symbols = symbol_table)

-            hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset))
+            try:
+                hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset))
+            except exceptions.InvalidAddressException:
+                vollog.warning("Couldn't create RegistryHive layer at offset {}, skipping".format(hex(hive_offset)))
+                continue
            context.layers.add_layer(hive)
            yield hive