From 6972ae1cc8bfce5e3b4c69e65279418d97a76251 Mon Sep 17 00:00:00 2001 From: cecio Date: Tue, 8 Sep 2020 17:07:46 +0200 Subject: [PATCH] in vadinfo.py, modified an exception handling and maxsize comparison --- volatility/framework/plugins/windows/vadinfo.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 4ed75195d..079628b53 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -3,7 +3,7 @@ # import logging -from typing import Callable, List, Generator, Iterable +from typing import Callable, List, Generator, Iterable, Optional from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements @@ -109,7 +109,7 @@ class VadInfo(interfaces.plugins.PluginInterface): @classmethod def vad_dump(cls, context: interfaces.context.ContextInterface, proc: interfaces.objects.ObjectInterface, vad: interfaces.objects.ObjectInterface, - maxsize = MAXSIZE_DEFAULT) -> interfaces.plugins.FileInterface: + maxsize = MAXSIZE_DEFAULT) -> Optional[interfaces.plugins.FileInterface]: """Extracts the complete data for Vad as a FileInterface. Args: @@ -125,11 +125,11 @@ class VadInfo(interfaces.plugins.PluginInterface): try: vad_start = vad.get_start() vad_end = vad.get_end() - except Exception as excp: - vollog.debug("Unable to get VAD information") + except exceptions.AttributeError: + vollog.debug("Unable to find the starting/ending VPN member") return - if maxsize != 0 and (vad_end - vad_start) > maxsize: + if maxsize > 0 and (vad_end - vad_start) > maxsize: vollog.debug("Skip VAD dump {0:#x}-{1:#x} due to maxsize limit".format(vad_start, vad_end)) return