From 85ec26db911adc0e845a2a8ffdfa4b69ef5d72fc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 15:55:52 -0500 Subject: [PATCH] Shimcachemem: Changes absent value return type This is more appropriately set to `renderers.UnreadableValue` since it is set when an `exceptions.InvalidAddressException` occurs. --- volatility3/framework/symbols/windows/extensions/shimcache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 9e75e7579..3b32d30c7 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -57,7 +57,7 @@ class SHIM_CACHE_ENTRY(objects.StructType): if not self._context.layers[self.vol.native_layer_name].is_valid( blob_offset, blob_size ): - self._exec_flag = renderers.UnparsableValue() + self._exec_flag = renderers.UnreadableValue() return self._exec_flag raw_flag = self._context.layers[self.vol.native_layer_name].read(