diff --git a/volatility/framework/exceptions.py b/volatility/framework/exceptions.py index b112abaee..ebbea2927 100644 --- a/volatility/framework/exceptions.py +++ b/volatility/framework/exceptions.py @@ -88,10 +88,6 @@ class LayerException(VolatilityException): self.layer_name = layer_name -class StructureException(VolatilityException): - """Thrown when an error occurs dealing with an expected structure type.""" - - class UnsatisfiedException(VolatilityException): def __init__(self, unsatisfied: Dict[str, interfaces.configuration.RequirementInterface]) -> None: diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index ceccf9f86..d78569b9e 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -54,7 +54,8 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): # Verify that it is a supported format if self.header.DumpType != 0x1: - raise WindowsCrashDump32FormatException("unsupported dump format 0x{:x}".format(self.header.DumpType)) + raise WindowsCrashDump32FormatException(self.name, + "unsupported dump format 0x{:x}".format(self.header.DumpType)) super().__init__(context, config_path, name) @@ -72,7 +73,8 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): offset += x.PageCount if len(segments) == 0: - raise WindowsCrashDump32FormatException("No Crash segments defined in {}".format(self._base_layer)) + raise WindowsCrashDump32FormatException(self.name, + "No Crash segments defined in {}".format(self._base_layer)) self._segments = segments @@ -83,15 +85,16 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): try: header_data = base_layer.read(offset, cls._magic_struct.size) except exceptions.InvalidAddressException: - raise WindowsCrashDump32FormatException("Crashdump header not found at offset {}".format(offset)) + raise WindowsCrashDump32FormatException(base_layer.name, + "Crashdump header not found at offset {}".format(offset)) (signature, validdump) = cls._magic_struct.unpack(header_data) if signature != cls.SIGNATURE: - raise WindowsCrashDump32FormatException("bad signature 0x{:x} at file offset 0x{:x}".format( - signature, offset)) + raise WindowsCrashDump32FormatException( + base_layer.name, "Bad signature 0x{:x} at file offset 0x{:x}".format(signature, offset)) if validdump != cls.VALIDDUMP: - raise WindowsCrashDump32FormatException("invalid dump 0x{:x} at file offset 0x{:x}".format( - validdump, offset)) + raise WindowsCrashDump32FormatException( + base_layer.name, "Invalid dump 0x{:x} at file offset 0x{:x}".format(validdump, offset)) return (signature, validdump) diff --git a/volatility/framework/layers/lime.py b/volatility/framework/layers/lime.py index 3ea6afedd..5df004dd8 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility/framework/layers/lime.py @@ -46,8 +46,8 @@ class LimeLayer(segmented.SegmentedLayer): start, end = self._check_header(base_layer, offset) if start < maxaddr or end < start: - raise LimeFormatException("bad start/end 0x{:x}/0x{:x} at file offset 0x{:x}".format( - start, end, offset)) + raise LimeFormatException( + self.name, "Bad start/end 0x{:x}/0x{:x} at file offset 0x{:x}".format(start, end, offset)) segment_length = end - start + 1 segments.append((start, offset + header_size, segment_length)) @@ -55,7 +55,7 @@ class LimeLayer(segmented.SegmentedLayer): offset = offset + header_size + segment_length if len(segments) == 0: - raise LimeFormatException("No LiME segments defined in {}".format(self._base_layer)) + raise LimeFormatException(self.name, "No LiME segments defined in {}".format(self._base_layer)) self._segments = segments @@ -64,12 +64,14 @@ class LimeLayer(segmented.SegmentedLayer): try: header_data = base_layer.read(offset, cls._header_struct.size) except exceptions.InvalidAddressException: - raise LimeFormatException("Offset 0x{:0x} does not exist within the base layer".format(offset)) + raise LimeFormatException(base_layer.name, + "Offset 0x{:0x} does not exist within the base layer".format(offset)) (magic, version, start, end, reserved) = cls._header_struct.unpack(header_data) if magic != cls.MAGIC: - raise LimeFormatException("bad magic 0x{:x} at file offset 0x{:x}".format(magic, offset)) + raise LimeFormatException(base_layer.name, "Bad magic 0x{:x} at file offset 0x{:x}".format(magic, offset)) if version != cls.VERSION: - raise LimeFormatException("unexpected version {:d} at file offset 0x{:x}".format(version, offset)) + raise LimeFormatException(base_layer.name, + "Unexpected version {:d} at file offset 0x{:x}".format(version, offset)) return start, end diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 71e6f26cc..bb1166d62 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -46,8 +46,8 @@ class RegistryHive(linear.LinearlyMappedLayer): # TODO: Check the checksum if self.hive.Signature != 0xbee0bee0: - raise RegistryFormatException("Registry hive at {} does not have a valid signature".format( - self._hive_offset)) + raise RegistryFormatException( + self.name, "Registry hive at {} does not have a valid signature".format(self._hive_offset)) # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer @@ -197,7 +197,7 @@ class RegistryHive(linear.LinearlyMappedLayer): # Ignore the volatile bit when determining maxaddr validity volatile = self._mask(offset, 31, 31) >> 31 if offset & 0x7fffffff > self._get_hive_maxaddr(volatile): - raise RegistryInvalidIndex("Mapping request for value greater than maxaddr") + raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr") storage = self.hive.Storage[volatile] dir_index = self._mask(offset, 30, 21) >> 21 diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 3d4e85584..b21a60c4d 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -62,7 +62,7 @@ class PrintKey(interfaces.plugins.PluginInterface): return node = node_path[-1] if node.vol.type_name.endswith(constants.BANG + '_CELL_DATA'): - raise RegistryFormatException("Encountered _CELL_DATA instead of _CM_KEY_NODE") + raise RegistryFormatException(hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE") key_path = node.get_key_path() last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart)