From 86945492a71c07d718bf5db8c95c87f31bf88f89 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 3 Apr 2025 16:49:27 +0100 Subject: [PATCH] Volshell: display if embedded struct offest is unreadable in dt output --- volatility3/cli/volshell/generic.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index e80d65957..a524efe38 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -622,7 +622,12 @@ class Volshell(interfaces.plugins.PluginInterface): elif isinstance(value, objects.Array): return repr([self._display_value(val) for val in value]) else: - return f"offset: {hex(value.vol.offset)}" + if self.context.layers[self.current_layer].is_valid( + value.vol.offset + ): + return f"offset: {hex(value.vol.offset)}" + else: + return f"offset: {hex(value.vol.offset)} (unreadable)" else: # non volobject if value is None: