From e21eb57b9009dec3046ac1c9d5e2e4cf93b42b6c Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 18:40:51 +0000 Subject: [PATCH 1/2] Volshell: handle case where paged out member would cause backtrace for dt output. Thanks to @atcuno for the code! --- volatility3/cli/volshell/generic.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 3a5d514fe..c153d281d 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -446,8 +446,14 @@ class Volshell(interfaces.plugins.PluginInterface): len_offset = len(hex(relative_offset)) len_member = len(member) len_typename = len(member_type.vol.type_name) + if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data + try: + value = self._display_value(getattr(volobject, member)) + except exceptions.InvalidAddressException: + value = self._display_value(renderers.NotAvailableValue()) + print( " " * (longest_offset - len_offset), hex(relative_offset), @@ -458,7 +464,7 @@ class Volshell(interfaces.plugins.PluginInterface): member_type.vol.type_name, " " * (longest_typename - len_typename), " ", - self._display_value(getattr(volobject, member)), + value, ) else: print( @@ -473,7 +479,9 @@ class Volshell(interfaces.plugins.PluginInterface): @classmethod def _display_value(cls, value: Any) -> str: - if isinstance(value, objects.PrimitiveObject): + if isinstance(value, interfaces.renderers.BaseAbsentValue): + return "N/A" + elif isinstance(value, objects.PrimitiveObject): return repr(value) elif isinstance(value, objects.Array): return repr([cls._display_value(val) for val in value]) From 23f2157931df51ff79d02f7d34e39691451e240a Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 18:50:10 +0000 Subject: [PATCH 2/2] Volshell: update display_type to handle struct members that are also python functions, e.g. write(). Thanks to @atcuno for the suggestion --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index c153d281d..a487fa3cd 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -450,7 +450,7 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data try: - value = self._display_value(getattr(volobject, member)) + value = self._display_value(volobject.member(member)) except exceptions.InvalidAddressException: value = self._display_value(renderers.NotAvailableValue())