From 627caab55bdcd3fa0b9cbb1f9e6dd875983016bb Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 8 Dec 2017 00:55:29 +0000 Subject: [PATCH] Fix up exception in DTBtests. The exception was being caused by reading too little data from the stream. We now skip it if that happens. --- volatility/framework/automagic/windows.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 4601a988f..54dda84fa 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -71,7 +71,10 @@ class DtbTest(validity.ValidityRoutines): """ value = data[page_offset + (self.ptr_reference * self.ptr_size):page_offset + ( (self.ptr_reference + 1) * self.ptr_size)] - ptr = self._unpack(value) + try: + ptr = self._unpack(value) + except struct.error: + return None # The value *must* be present (bit 0) since it's a mapped page # It's almost always writable (bit 1) # It's occasionally Super, but not reliably so, haven't checked when/why not