catch InvalidAddressException when creating RegistryHive

2026-09-10 03:37:39 +02:00 · 2019-09-12 15:37:40 -05:00
parent f7dec8de86
commit cf8871b1bc
1 changed files with 5 additions and 1 deletions
@@ -76,7 +76,11 @@ class HiveList(plugins.PluginInterface):
                base_layer = layer_name,
                nt_symbols = symbol_table)

-            hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset))
+            try:
+                hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset))
+            except exceptions.InvalidAddressException:
+                vollog.warning("Couldn't create RegistryHive layer at offset {}, skipping".format(hex(hive_offset)))
+                continue
            context.layers.add_layer(hive)
            yield hive