From 2153b742a1dbde57b369adb34fedc5e05e5eb40c Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Mon, 30 Dec 2024 18:06:04 +0000
Subject: [PATCH 1/2] Fix uncheck read() call and remove variable that would
 not be definied if exception triggers

---
 .../plugins/windows/skeleton_key_check.py     | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py
index f5d7e1b3a..b103bc831 100644
--- a/volatility3/framework/plugins/windows/skeleton_key_check.py
+++ b/volatility3/framework/plugins/windows/skeleton_key_check.py
@@ -289,7 +289,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
 
             except exceptions.InvalidAddressException as excp:
                 vollog.debug(
-                    f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}"
+                    f"Invalid address {excp.invalid_address} in layer {excp.layer_name}"
                 )
 
         return None, None
@@ -431,15 +431,20 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
 
                     # we do not want to fail just because the count is not in memory
                     # 16 was the size on samples I tested, so I chose it as the default
+                    count = 16
+
                     if target_address:
-                        count = int.from_bytes(
-                            self.context.layers[proc_layer_name].read(
-                                target_address, 4
-                            ),
-                            "little",
-                        )
-                    else:
-                        count = 16
+                        try:
+                            count = int.from_bytes(
+                                self.context.layers[proc_layer_name].read(
+                                    target_address, 4
+                                ),
+                                "little",
+                            )
+                        except exceptions.InvalidAddressException:
+                            vollog.debug(
+                                "Unable to read `cCsystems`. Defaulting to 16."
+                            )
 
                     found_count = True
 

From a3844e8bc54f9d597d459005830e733bd73d7256 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Mon, 30 Dec 2024 18:08:30 +0000
Subject: [PATCH 2/2] Fix uncheck read() call and remove variable that would
 not be definied if exception triggers

---
 volatility3/framework/plugins/windows/skeleton_key_check.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py
index b103bc831..6ae07381a 100644
--- a/volatility3/framework/plugins/windows/skeleton_key_check.py
+++ b/volatility3/framework/plugins/windows/skeleton_key_check.py
@@ -282,7 +282,6 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
 
         for proc in proc_list:
             try:
-                proc_id = proc.UniqueProcessId
                 proc_layer_name = proc.add_process_layer()
 
                 return proc, proc_layer_name