From d29c23e922d22b5ccce0f4bc2ac439acd695a31c Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 7 Dec 2024 15:51:35 +0000
Subject: [PATCH] Windows: Protect against missing _MM_SESSION_SPACE symbol

---
 volatility3/framework/symbols/windows/extensions/__init__.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index ecfc2f163..793e506c3 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -825,6 +825,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
                 constants.LOGLEVEL_VVV,
                 f"Cannot access _EPROCESS.Session.SessionId at {self.vol.offset:#x}",
             )
+        except exceptions.SymbolError:
+            vollog.log(
+                constants.LOGLEVEL_VVV,
+                "Could not lookup _MM_SESSION_SPACE in symbol table",
+            )
 
         return renderers.UnreadableValue()