Merge pull request #1686 from volatilityfoundation/fix_fbdev

Update fbdev plugin to gracefully handle old/broken symbol tables

volatility3/framework/plugins/linux/graphics/fbdev.py

@@ -255,22 +255,28 @@ You can try using ffmpeg to decode the raw buffer. Example usage:
             vollog.error(
                 "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml."
             )
-            return None
+            return
 
         kernel_name = self.config["kernel"]
         kernel = self.context.modules[kernel_name]
 
         if not kernel.has_symbol("num_registered_fb"):
-            raise exceptions.SymbolError(
-                "num_registered_fb",
-                kernel.symbol_table_name,
-                "The provided symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.",
+            vollog.error(
+                '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version,  your symbol table is corrupt, or the fbdev driver is compiled as a kernel module.'
             )
+            return
+
+        try:
+            num_registered_fb = kernel.object_from_symbol("num_registered_fb")
+        except exceptions.SymbolError:
+            vollog.error(
+                'Creating an object from "num_registered_fb" caused a symbol error. This is a sign that the symbol table is outdated. Please re-generate your symbol table using the latest dwarf2json'
+            )
+            return
 
-        num_registered_fb = kernel.object_from_symbol("num_registered_fb")
         if num_registered_fb < 1:
             vollog.info("No registered framebuffer in the fbdev API.")
-            return None
+            return
 
         registered_fb = kernel.object_from_symbol("registered_fb")
         fb_info_list = utility.array_of_pointers(