WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

in vadinfo.py, modified an exception handling and maxsize comparison

Browse Source
This commit is contained in:
cecio
2020-09-08 23:32:54 +01:00
committed by ikelos
parent d74032fd53
commit 6972ae1cc8
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vadinfo.py
+5 -5
View File
@@ -3,7 +3,7 @@
#
import logging
from typing import Callable, List, Generator, Iterable
from typing import Callable, List, Generator, Iterable, Optional
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
@@ -109,7 +109,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
@classmethod
def vad_dump(cls, context: interfaces.context.ContextInterface, proc: interfaces.objects.ObjectInterface,
vad: interfaces.objects.ObjectInterface,
maxsize = MAXSIZE_DEFAULT) -> interfaces.plugins.FileInterface:
maxsize = MAXSIZE_DEFAULT) -> Optional[interfaces.plugins.FileInterface]:
"""Extracts the complete data for Vad as a FileInterface.
Args:
@@ -125,11 +125,11 @@ class VadInfo(interfaces.plugins.PluginInterface):
try:
vad_start = vad.get_start()
vad_end = vad.get_end()
except Exception as excp:
vollog.debug("Unable to get VAD information")
except exceptions.AttributeError:
vollog.debug("Unable to find the starting/ending VPN member")
return
if maxsize != 0 and (vad_end - vad_start) > maxsize:
if maxsize > 0 and (vad_end - vad_start) > maxsize:
vollog.debug("Skip VAD dump {0:#x}-{1:#x} due to maxsize limit".format(vad_start, vad_end))
return