Skip to content

Commit 24a53b4

Browse files
committed
Prevent truecrypt from throwing a backtrace when the module isn't found and print a warning
1 parent 0b6203c commit 24a53b4

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

volatility3/framework/plugins/windows/truecrypt.py

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
33
#
44

5+
import logging
6+
57
from typing import Iterable, Generator, List, Tuple
68

79
from volatility3.framework import constants, interfaces, renderers
@@ -17,6 +19,8 @@
1719

1820
from volatility3.plugins.windows import modules
1921

22+
vollog = logging.getLogger(__name__)
23+
2024

2125
class Passphrase(interfaces.plugins.PluginInterface):
2226
"""TrueCrypt Cached Passphrase Finder"""
@@ -123,11 +127,18 @@ def _generator(self):
123127
mods: Iterable[ObjectInterface] = modules.Modules.list_modules(
124128
self.context, self.config["kernel"]
125129
)
126-
truecrypt_module_base = next(
127-
mod.DllBase
128-
for mod in mods
129-
if mod.BaseDllName.get_string().lower() == "truecrypt.sys"
130-
)
130+
try:
131+
truecrypt_module_base = next(
132+
mod.DllBase
133+
for mod in mods
134+
if mod.BaseDllName.get_string().lower() == "truecrypt.sys"
135+
)
136+
except StopIteration:
137+
vollog.warning(
138+
"Truecrypt module not found in the modules list. Unable to proceed."
139+
)
140+
return
141+
131142
for offset, password in self.scan_module(
132143
truecrypt_module_base, kernel.layer_name
133144
):

0 commit comments

Comments
 (0)