From 3b7317971de4891817bc50f463ba8a78d4ad765b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 19:55:28 +0000 Subject: [PATCH 1/2] Fix error handling and reporting around PE reconstruction calls --- volatility3/framework/plugins/windows/iat.py | 20 +++++++++++++++---- .../framework/plugins/windows/pe_symbols.py | 2 +- .../framework/plugins/windows/verinfo.py | 7 ++++++- 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 701db5734..acd3aaea2 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -69,11 +69,23 @@ class IAT(interfaces.plugins.PluginInterface): layer_name=proc_layer_name, ) - for offset, data in dos_header.reconstruct(): - pe_data.seek(offset) - pe_data.write(data) + try: + for offset, data in dos_header.reconstruct(): + pe_data.seek(offset) + pe_data.write(data) + except (exceptions.InvalidAddressException, ValueError) as excp: + vollog.debug( + f"Exception triggered when reconstructing PE file for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Output file may be corrupt and/or truncated." + ) + + try: + pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True) + except pefile.PEFormatError as excp: + vollog.debug( + f"Exception triggered when creating PE file object for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Unable to extract file." + ) + continue - pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True) pe_obj.parse_data_directories( [pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"]] ) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 270c6a174..0faf4a698 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -327,7 +327,7 @@ class PESymbols(interfaces.plugins.PluginInterface): pe_ret = pefile.PE(data=pe_data.getvalue(), fast_load=True) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, ValueError): pe_ret = None return pe_ret diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index fa7d4e113..49bf0b212 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -176,7 +176,12 @@ class VerInfo(interfaces.plugins.PluginInterface): (major, minor, product, build) = self.get_version_information( self._context, pe_table_name, session_layer_name, mod.DllBase ) - except (exceptions.InvalidAddressException, TypeError, AttributeError): + except ( + exceptions.InvalidAddressException, + ValueError, + TypeError, + AttributeError, + ): (major, minor, product, build) = [renderers.UnreadableValue()] * 4 if ( not isinstance(BaseDllName, renderers.UnreadableValue) From 0d3b155766ce4803ab718bfcb2e296bc7ba0dd41 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:50:51 +0000 Subject: [PATCH 2/2] Change debug to warning to always notify user --- volatility3/framework/plugins/windows/iat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index acd3aaea2..f2ba8e576 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -74,7 +74,7 @@ class IAT(interfaces.plugins.PluginInterface): pe_data.seek(offset) pe_data.write(data) except (exceptions.InvalidAddressException, ValueError) as excp: - vollog.debug( + vollog.warning( f"Exception triggered when reconstructing PE file for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Output file may be corrupt and/or truncated." )