diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility/framework/plugins/windows/driverirp.py index a21d0d1e6..240a64dba 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility/framework/plugins/windows/driverirp.py @@ -42,7 +42,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): try: driver_name = driver.get_driver_name() - except exceptions.InvalidAddressException: + except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() for i, address in enumerate(driver.MajorFunction): diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility/framework/plugins/windows/driverscan.py index 47565a161..8cf097aef 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility/framework/plugins/windows/driverscan.py @@ -54,7 +54,7 @@ class DriverScan(interfaces.plugins.PluginInterface): try: driver_name = driver.get_driver_name() - except exceptions.InvalidAddressException: + except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() try: diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index cc6ad4dc9..f504eb98c 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -319,7 +319,7 @@ class Handles(interfaces.plugins.PluginInterface): else: try: obj_name = entry.NameInfo.Name.String - except exceptions.InvalidAddressException: + except (ValueError, exceptions.InvalidAddressException): obj_name = "" except (exceptions.InvalidAddressException): diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility/framework/plugins/windows/mutantscan.py index 10f5c776d..24356d120 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility/framework/plugins/windows/mutantscan.py @@ -52,7 +52,7 @@ class MutantScan(interfaces.plugins.PluginInterface): try: name = mutant.get_name() - except exceptions.InvalidAddressException: + except (ValueError, exceptions.InvalidAddressException): name = renderers.NotApplicableValue() yield (0, (format_hints.Hex(mutant.vol.offset), name)) diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility/framework/plugins/windows/symlinkscan.py index ee41f3d84..44b6efd95 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility/framework/plugins/windows/symlinkscan.py @@ -53,7 +53,7 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa try: from_name = link.get_link_name() - except exceptions.InvalidAddressException: + except (ValueError, exceptions.InvalidAddressException): continue try: diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index f06c40f94..ff917bbbc 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -362,7 +362,10 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): name = renderers.UnreadableValue() # type: Union[str, interfaces.renderers.BaseAbsentValue] if self._context.layers[self.vol.layer_name].is_valid(self.DeviceObject): - name = "\\Device\\{}".format(self.DeviceObject.get_device_name()) + try: + name = "\\Device\\{}".format(self.DeviceObject.get_device_name()) + except ValueError: + pass try: name += self.FileName.String diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility/framework/symbols/windows/extensions/pool.py index e4ae00e0e..42c49a8b2 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility/framework/symbols/windows/extensions/pool.py @@ -294,6 +294,11 @@ class OBJECT_HEADER(objects.StructType): layer_name = self.vol.native_layer_name, offset = kvo + address + calculated_index) + if header_offset == 0: + raise ValueError( + "Could not find _OBJECT_HEADER_NAME_INFO for object at {} of layer {}".format(self.vol.offset, + self.vol.layer_name)) + header = self._context.object(symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO", layer_name = self.vol.layer_name, offset = self.vol.offset - header_offset,