Windows: Protect against missing _MM_SESSION_SPACE symbol

This commit is contained in:
Mike Auty
2024-12-07 15:52:58 +00:00
parent 78e3ee26a0
commit d29c23e922
@@ -825,6 +825,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
constants.LOGLEVEL_VVV,
f"Cannot access _EPROCESS.Session.SessionId at {self.vol.offset:#x}",
)
except exceptions.SymbolError:
vollog.log(
constants.LOGLEVEL_VVV,
"Could not lookup _MM_SESSION_SPACE in symbol table",
)
return renderers.UnreadableValue()