From ce22fc59fa16953f552ff06f502c32e6480c6e57 Mon Sep 17 00:00:00 2001
From: memoryforensics1 <61626429+memoryforensics1@users.noreply.github.com>
Date: Tue, 29 Sep 2020 21:29:01 +0300
Subject: [PATCH] Update __init__.py

---
 volatility/framework/symbols/windows/extensions/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py
index c2da76c65..ecee9bc84 100644
--- a/volatility/framework/symbols/windows/extensions/__init__.py
+++ b/volatility/framework/symbols/windows/extensions/__init__.py
@@ -678,7 +678,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
             block = self.get_peb().ProcessParameters.Environment
             try:
                 block_size = self.get_peb().ProcessParameters.EnvironmentSize
-            except:
+            except AttributeError: # Windows XP
                 block_size = self.get_peb().ProcessParameters.Length
             envars = context.layers[process_space].read(block, block_size).decode("utf-16-le", errors='replace').split('\x00')[:-1]
         except exceptions.InvalidAddressException: