From f703da197b365083aee770d40255e1d722619da8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:19:13 -0600 Subject: [PATCH] Windows Extensions: Fix traceback when accessing peb.Ldr This fixes a simple InvalidAddressException traceback by just catching the exception on the member access and continuing. Co-authored-by: Andrew Case --- .../framework/symbols/windows/extensions/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index fd9e2f415..e852de0da 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -874,6 +874,12 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: sym_table = self.get_symbol_table_name() + # Fixes #1636 + try: + peb.Ldr + except exceptions.InvalidAddressException: + continue + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ("unsigned long"): sym_table = self.set_types(peb)