mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
Windows: Protect against missing _MM_SESSION_SPACE symbol
This commit is contained in:
@@ -825,6 +825,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
|
||||
constants.LOGLEVEL_VVV,
|
||||
f"Cannot access _EPROCESS.Session.SessionId at {self.vol.offset:#x}",
|
||||
)
|
||||
except exceptions.SymbolError:
|
||||
vollog.log(
|
||||
constants.LOGLEVEL_VVV,
|
||||
"Could not lookup _MM_SESSION_SPACE in symbol table",
|
||||
)
|
||||
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
|
||||
Reference in New Issue
Block a user