From b15e69e11dad74e5a7ee321b8a3fdfd416dde71b Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 1 Jun 2021 13:55:21 -0500 Subject: [PATCH] ensure the crashinfo plugin gets a crash layer --- volatility3/framework/plugins/windows/crashinfo.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py index 5ec123b44..8797a4855 100644 --- a/volatility3/framework/plugins/windows/crashinfo.py +++ b/volatility3/framework/plugins/windows/crashinfo.py @@ -8,6 +8,7 @@ from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, conversion from volatility3.framework.objects import utility +from volatility3.framework.layers import crash vollog = logging.getLogger(__name__) @@ -63,6 +64,10 @@ class Crashinfo(interfaces.plugins.PluginInterface): def run(self): layer = self._context.layers[self.config['primary.memory_layer']] + if not isinstance(layer, crash.WindowsCrashDump32Layer): + vollog.error("This plugin requires a Windows crash dump") + raise + return renderers.TreeGrid([("Signature", str), ("MajorVersion", int), ("MinorVersion", int),