WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 22:52:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows Cmdline: Clean up output

Browse Source 
The strings being used as return values here would (IMO) be better as
debug statements, with the plugin returning
`renderers.UnreadableValue()` for any of the `InvalidAddressException`
code paths.
This commit is contained in:
David McDonald
2025-02-12 10:11:23 -06:00
parent 8dceeb2144
commit bcbfc27d4f
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/cmdline.py
+13 -3
View File
@@ -70,6 +70,7 @@ class CmdLine(interfaces.plugins.PluginInterface):
for proc in procs:
process_name = utility.array_to_string(proc.ImageFileName)
proc_id = "Unknown"
result_text = None
try:
proc_id = proc.UniqueProcessId
@@ -78,13 +79,22 @@ class CmdLine(interfaces.plugins.PluginInterface):
)
except exceptions.SwappedInvalidAddressException as exp:
result_text = f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)"
vollog.debug(
f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)"
)
except exceptions.PagedInvalidAddressException as exp:
result_text = f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)"
vollog.debug(
f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)"
)
except exceptions.InvalidAddressException as exp:
result_text = f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)"
vollog.debug(
f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)"
)
if not result_text:
result_text = renderers.UnreadableValue()
yield (0, (proc.UniqueProcessId, process_name, result_text))