Windows Extensions: Fix traceback when accessing peb.Ldr

This fixes a simple InvalidAddressException traceback by just catching
the exception on the member access and continuing.

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent 57c6afd0fc
commit f703da197b
@@ -874,6 +874,12 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
for peb in pebs:
sym_table = self.get_symbol_table_name()
# Fixes #1636
try:
peb.Ldr
except exceptions.InvalidAddressException:
continue
if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ("unsigned long"):
sym_table = self.set_types(peb)