From db55f23070b16d8c9df40e1ddfda5df8a6ad3282 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Mon, 30 Sep 2024 16:55:27 -0500
Subject: [PATCH] Windows: Callbacks - fix breaking API change

Moves as much of the `is_parseable` check as possible back into an
`is_valid` method to avoid breaking API changes.
---
 .../symbols/windows/extensions/callbacks.py   | 33 ++++++++++++++-----
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/volatility3/framework/symbols/windows/extensions/callbacks.py b/volatility3/framework/symbols/windows/extensions/callbacks.py
index 62e72803e..f54db39f2 100644
--- a/volatility3/framework/symbols/windows/extensions/callbacks.py
+++ b/volatility3/framework/symbols/windows/extensions/callbacks.py
@@ -15,7 +15,7 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
     It exposes a function which sanity-checks structure members.
     """
 
-    def is_parseable(self, type_map: Dict[int, str]) -> bool:
+    def is_valid(self) -> bool:
         """
         Perform some checks.
         """
@@ -30,6 +30,25 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
                 )
                 return False
 
+        except exceptions.InvalidAddressException:
+            vollog.debug(
+                f"callback obj 0x{self.vol.offset:x} invalid due to invalid address access"
+            )
+            return False
+
+        return True
+
+    def is_parseable(self, type_map: Dict[int, str]) -> bool:
+        """
+        Determines whether or not this `_SHUTDOWN_PACKET` callback can be reliably parsed.
+        Requires a `type_map` that maps NT executive object type indices to string representations.
+        This type map can be acquired via the `handles.Handles.get_type_map` classmethod.
+        """
+        if not self.is_valid():
+            return False
+
+        try:
+
             device = self.DeviceObject
             if not device or not (device.DriverObject.DriverStart % 0x1000 == 0):
                 vollog.debug(
@@ -37,13 +56,6 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
                 )
                 return False
 
-        except exceptions.InvalidAddressException:
-            vollog.debug(
-                f"callback obj 0x{self.vol.offset:x} invalid due to invalid address access"
-            )
-            return False
-
-        try:
             header = device.get_object_header()
             object_type = header.get_object_type(type_map)
             is_valid = object_type == "Device"
@@ -52,6 +64,11 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
                     f"Callback obj 0x{self.vol.offset:x} invalid due to invalid device type: wanted 'Device', found '{object_type}'"
                 )
             return is_valid
+        except exceptions.InvalidAddressException:
+            vollog.debug(
+                f"callback obj 0x{self.vol.offset:x} invalid due to invalid address access"
+            )
+            return False
         except ValueError:
             vollog.debug(
                 f"Could not get object type for object at 0x{self.vol.offset:x}"