diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index b6ac9e3b5..daeac0d85 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -76,7 +76,11 @@ class HiveList(plugins.PluginInterface): base_layer = layer_name, nt_symbols = symbol_table) - hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset)) + try: + hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset)) + except exceptions.InvalidAddressException: + vollog.warning("Couldn't create RegistryHive layer at offset {}, skipping".format(hex(hive_offset))) + continue context.layers.add_layer(hive) yield hive