mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-05 17:27:38 +02:00
Windows Extensions: Fix traceback when accessing peb.Ldr
This fixes a simple InvalidAddressException traceback by just catching the exception on the member access and continuing. Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
co-authored by
Andrew Case
parent
57c6afd0fc
commit
f703da197b
@@ -874,6 +874,12 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
|
||||
|
||||
for peb in pebs:
|
||||
sym_table = self.get_symbol_table_name()
|
||||
# Fixes #1636
|
||||
try:
|
||||
peb.Ldr
|
||||
except exceptions.InvalidAddressException:
|
||||
continue
|
||||
|
||||
if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ("unsigned long"):
|
||||
sym_table = self.set_types(peb)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user