Skip to content

Commit 2641e5f

Browse files
committed
ShimcacheMem: Fix exc getting module name
`module.BaseDll.String` can raise an `InvalidAddressException`, this catches it and continues through the loop.
1 parent 85ec26d commit 2641e5f

File tree

1 file changed

+13
-7
lines changed

1 file changed

+13
-7
lines changed

volatility3/framework/plugins/windows/shimcachemem.py

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -582,13 +582,19 @@ def get_module_section_range(
582582
:return: The offset and size of the module, if found; Otherwise, returns `None`
583583
"""
584584

585-
try:
586-
krnl_mod = next(
587-
module
588-
for module in modules.Modules.list_modules(context, kernel_module_name)
589-
if module.BaseDllName.String in module_list
590-
)
591-
except StopIteration:
585+
krnl_mod = None
586+
for module in modules.Modules.list_modules(context, kernel_module_name):
587+
try:
588+
if module.BaseDllName.String in module_list:
589+
krnl_mod = module
590+
break
591+
except exceptions.InvalidAddressException as exc:
592+
vollog.warning(
593+
f"Failed to get kernel module due to {exc.__class__.__name__}: {exc.invalid_address:#x}"
594+
)
595+
596+
if krnl_mod is None:
597+
vollog.warning("Failed to find kernel module")
592598
return None
593599

594600
kernel = context.modules[kernel_module_name]

0 commit comments

Comments
 (0)