Skip to content

Commit 1d1af69

Browse files
committed
Windows: Handles - catch exception in handle iteration
An `InvalidAddressException` can occur inside of `__iter__` when iterating over the handle table (the exact exception occurs when creating the subtype in `objects.Array.__getitem__`. This changes the handle code to do a manual iteration over the sequence using the array length and indexes, catch the exception, log the index, and continue. In the test sample that prompted this change, the exception occurred on the access of the very last item in the array. closes #1573
1 parent ad90804 commit 1d1af69

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

volatility3/framework/plugins/windows/handles.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,12 @@ def _make_handle_array(self, offset, level, depth=0):
243243
layer_object = self.context.layers[virtual]
244244
masked_offset = offset & layer_object.maximum_address
245245

246-
for entry in table:
246+
for i in range(len(table)):
247+
try:
248+
entry = table[i]
249+
except exceptions.InvalidAddressException:
250+
vollog.debug(f"Failed to get handle table entry at index {i}")
251+
continue
247252
# This triggered a backtrace in many testing samples
248253
# in the level == 0 path
249254
# The code above this calls `is_valid` on the `offset`

0 commit comments

Comments
 (0)