fix(Windows: Handles): Unreliable SAR value on 24H2

Handles are not being decoded in 24H2+ samples. This is because the
`Handles._decode_pointer` method grabs the SAR shift value from the
disassemble function, but in these samples this value (`0x11`) is
incorrect. Adding a fallback to the default SAR value of `0x10` if the
obtained pointer is not valid in the kernel address space  resolves the
issue.

volatility3/framework/plugins/windows/handles.py

@@ -21,11 +21,14 @@ except ImportError:
     has_capstone = False
 
 
+DEFAULT_SAR_VALUE = 0x10  # to be used only when decoding fails
+
+
 class Handles(interfaces.plugins.PluginInterface):
     """Lists process open handles."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 2)
+    _version = (1, 0, 3)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -118,6 +121,10 @@ class Handles(interfaces.plugins.PluginInterface):
                         )
 
                 offset = self._decode_pointer(handle_table_entry.LowValue, magic)
+                if not self.context.layers[virtual].is_valid(offset):
+                    offset = self._decode_pointer(
+                        handle_table_entry.LowValue, DEFAULT_SAR_VALUE
+                    )
             else:
                 if handle_table_entry.InfoTable == 0:
                     return None
@@ -142,7 +149,6 @@ class Handles(interfaces.plugins.PluginInterface):
         pointers in the _HANDLE_TABLE_ENTRY which allows us to find the
         associated _OBJECT_HEADER.
         """
-        DEFAULT_SAR_VALUE = 0x10  # to be used only when decoding fails
 
         if self._sar_value is None:
             if not has_capstone: