From d285519ecb502b0d377d090e3fbd6d27895d3cfc Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 1 Jun 2021 14:17:31 -0500 Subject: [PATCH] don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer --- volatility3/framework/plugins/windows/crashinfo.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py index 8797a4855..47c18292f 100644 --- a/volatility3/framework/plugins/windows/crashinfo.py +++ b/volatility3/framework/plugins/windows/crashinfo.py @@ -63,8 +63,14 @@ class Crashinfo(interfaces.plugins.PluginInterface): )) def run(self): - layer = self._context.layers[self.config['primary.memory_layer']] - if not isinstance(layer, crash.WindowsCrashDump32Layer): + crash_layer = None + for layer_name in self._context.layers: + layer = self._context.layers[layer_name] + if isinstance(layer, crash.WindowsCrashDump32Layer): + crash_layer = layer + break + + if crash_layer is None: vollog.error("This plugin requires a Windows crash dump") raise @@ -85,4 +91,4 @@ class Crashinfo(interfaces.plugins.PluginInterface): ("BitmapHeaderSize", format_hints.Hex), ("BitmapSize", format_hints.Hex), ("BitmapPages", format_hints.Hex), - ], self._generator(layer)) \ No newline at end of file + ], self._generator(crash_layer)) \ No newline at end of file