Merge pull request #1497 from volatilityfoundation/issue_1477_skeleton_key

Fix uncheck read() call and remove variable that would not be definie…

volatility3/framework/plugins/windows/skeleton_key_check.py

@@ -282,14 +282,13 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
 
         for proc in proc_list:
             try:
-                proc_id = proc.UniqueProcessId
                 proc_layer_name = proc.add_process_layer()
 
                 return proc, proc_layer_name
 
             except exceptions.InvalidAddressException as excp:
                 vollog.debug(
-                    f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}"
+                    f"Invalid address {excp.invalid_address} in layer {excp.layer_name}"
                 )
 
         return None, None
@@ -431,15 +430,20 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
 
                     # we do not want to fail just because the count is not in memory
                     # 16 was the size on samples I tested, so I chose it as the default
+                    count = 16
+
                     if target_address:
-                        count = int.from_bytes(
-                            self.context.layers[proc_layer_name].read(
-                                target_address, 4
-                            ),
-                            "little",
-                        )
-                    else:
-                        count = 16
+                        try:
+                            count = int.from_bytes(
+                                self.context.layers[proc_layer_name].read(
+                                    target_address, 4
+                                ),
+                                "little",
+                            )
+                        except exceptions.InvalidAddressException:
+                            vollog.debug(
+                                "Unable to read `cCsystems`. Defaulting to 16."
+                            )
 
                     found_count = True