Skip to content

Commit

Permalink
Windows: unloadedmodules bugfix
Browse files Browse the repository at this point in the history
This fixes a bug in the `windows.unloadedmodules` plugin. An
`InvalidAddressException` can be raised when parsing the module name;
this adds a try/except block to replace the missing module name with a
`renderers.UnreadableValue` when the exception occurs.
  • Loading branch information
dgmcdona committed Oct 3, 2024
1 parent d56cd83 commit e605bee
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions volatility3/framework/plugins/windows/unloadedmodules.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
from typing import List, Iterable

from volatility3.framework import constants
from volatility3.framework import interfaces, symbols
from volatility3.framework import interfaces, symbols, exceptions
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import configuration
Expand Down Expand Up @@ -132,10 +132,15 @@ def _generator(self):
kernel.symbol_table_name,
unloadedmodule_table_name,
):
try:
name = mod.Name.String
except exceptions.InvalidAddressException:
name = renderers.UnreadableValue()

yield (
0,
(
mod.Name.String,
name,
format_hints.Hex(mod.StartAddress),
format_hints.Hex(mod.EndAddress),
conversion.wintime_to_datetime(mod.CurrentTime),
Expand Down

0 comments on commit e605bee

Please sign in to comment.