From 745fce22815abeef518d5f03fd0cb27cfece06d0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 15 Nov 2020 23:56:07 +0000 Subject: [PATCH] Symbols: Fix pool error handling Fixes #375 --- volatility/framework/symbols/windows/extensions/pool.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility/framework/symbols/windows/extensions/pool.py index e61764be8..192fef2ba 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility/framework/symbols/windows/extensions/pool.py @@ -1,10 +1,13 @@ import functools +import logging import struct from typing import Optional, Tuple, List, Dict, Union from volatility.framework import objects, interfaces, constants, symbols, exceptions, renderers from volatility.framework.renderers import conversion +vollog = logging.getLogger(__name__) + class POOL_HEADER(objects.StructType): """A kernel pool allocation header. @@ -176,7 +179,7 @@ class POOL_HEADER(objects.StructType): header_type = context.symbol_space.get_type(type_name) headers.append(header) sizes.append(header_type.size) - except AttributeError: + except (AttributeError, exceptions.SymbolError): # Some of these may not exist, for example: # if build < 9200: PADDING_INFO else: AUDIT_INFO # if build == 10586: HANDLE_REVOCATION_INFO else EXTENDED_INFO