WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer

Browse Source
This commit is contained in:
iMHLv2
2021-06-01 14:17:31 -05:00
parent a0adbde994
commit d285519ecb
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/crashinfo.py
+9 -3
View File
@@ -63,8 +63,14 @@ class Crashinfo(interfaces.plugins.PluginInterface):
))
def run(self):
layer = self._context.layers[self.config['primary.memory_layer']]
if not isinstance(layer, crash.WindowsCrashDump32Layer):
crash_layer = None
for layer_name in self._context.layers:
layer = self._context.layers[layer_name]
if isinstance(layer, crash.WindowsCrashDump32Layer):
crash_layer = layer
break
if crash_layer is None:
vollog.error("This plugin requires a Windows crash dump")
raise
@@ -85,4 +91,4 @@ class Crashinfo(interfaces.plugins.PluginInterface):
("BitmapHeaderSize", format_hints.Hex),
("BitmapSize", format_hints.Hex),
("BitmapPages", format_hints.Hex),
], self._generator(layer))
], self._generator(crash_layer))