From e6a83f09d9647f6b30bedb9647d7265d319ebfe6 Mon Sep 17 00:00:00 2001 From: atcuno Date: Fri, 4 Feb 2022 09:14:55 -0600 Subject: [PATCH] Catch invalid processes returned from list_tasks #574 --- volatility3/framework/plugins/windows/pstree.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index fbb883839..942741e56 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -68,7 +68,11 @@ class PsTree(interfaces.plugins.PluginInterface): memory = self.context.layers[layer_name] (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] - self._processes[proc.UniqueProcessId] = proc, offset + try: + self._processes[proc.UniqueProcessId] = proc, offset + except exceptions.InvalidAddressException: + vollog.info("Invalid process at address {:#x}. Skipping".format(proc.vol.offset)) + continue # Build the child/level maps for pid in self._processes: