From b7ba877727a03d67a29b451e7ba74da9b2d46ff4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 14 Jan 2020 15:36:54 +0000 Subject: [PATCH] procdump: Enure proc_id is defined. --- volatility/framework/plugins/windows/procdump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 7ff60ae53..7993614a4 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -75,13 +75,13 @@ class ProcDump(interfaces.plugins.PluginInterface): for proc in procs: try: + proc_id = proc.UniqueProcessId process_name = utility.array_to_string(proc.ImageFileName) filedata = self.process_dump(self.context, self.config["nt_symbols"], pe_table_name, proc) self.produce_file(filedata) result_text = "Stored {}".format(filedata.preferred_filename) except ValueError: result_text = "PE parsing error" - except exceptions.SwappedInvalidAddressException as exp: result_text = "Process {}: Required memory at {:#x} is inaccessible (swapped)".format( proc_id, exp.invalid_address)