Skip to content

Commit 1d48931

Browse files
committed
Shimcache Extension: Fix logic error in exec_flag
Adds needed return statements in `exec_flag` method in order to avoid `InvalidAddressException` when reading from invalid memory after an `is_valid` check has already been performed.
1 parent 079d280 commit 1d48931

File tree

1 file changed

+5
-0
lines changed
  • volatility3/framework/symbols/windows/extensions

1 file changed

+5
-0
lines changed

volatility3/framework/symbols/windows/extensions/shimcache.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,12 +57,14 @@ def exec_flag(self) -> Union[bool, interfaces.renderers.BaseAbsentValue]:
5757
blob_offset, blob_size
5858
):
5959
self._exec_flag = renderers.UnparsableValue()
60+
return self._exec_flag
6061

6162
raw_flag = self._context.layers[self.vol.native_layer_name].read(
6263
blob_offset, blob_size
6364
)
6465
if not raw_flag:
6566
self._exec_flag = renderers.UnparsableValue()
67+
return self._exec_flag
6668

6769
try:
6870
self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
@@ -72,6 +74,7 @@ def exec_flag(self) -> Union[bool, interfaces.renderers.BaseAbsentValue]:
7274
else:
7375
# Always set to true for XP/2K3
7476
self._exec_flag = renderers.NotApplicableValue()
77+
7578
return self._exec_flag
7679

7780
@property
@@ -118,6 +121,8 @@ def last_update(self) -> Union[datetime, interfaces.renderers.BaseAbsentValue]:
118121
)
119122
except AttributeError:
120123
self._last_updated = renderers.NotApplicableValue()
124+
except exceptions.InvalidAddressException:
125+
self._last_updated = renderers.UnreadableValue()
121126

122127
return self._last_updated
123128

0 commit comments

Comments
 (0)