Prevent yielding smeared/broken modules from the unloaded module list

This commit is contained in:
Andrew Case
2025-02-07 18:05:16 -06:00
parent 789081e971
commit df55b7890d
@@ -117,7 +117,18 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt
)
unloadedmodules_array.UnloadedDrivers.count = unloaded_count
yield from unloadedmodules_array.UnloadedDrivers
for driver in unloadedmodules_array.UnloadedDrivers:
# Mass testing led to dozens of samples backtracing on this plugin when
# accessing members of modules coming out this list
# Given how often temporary drivers load and unload on Win10+, I
# assume the chance for smear is very high
try:
driver.StartAddress
driver.EndAddress
driver.CurrentTime
yield driver
except exceptions.InvalidAddressException:
continue
def _generator(self):
kernel = self.context.modules[self.config["kernel"]]