Merge pull request #1783 from volatilityfoundation/bugfix/shimcache_tracebacks

Windows Shimcachemem: Fix tracebacks

Author: ikelos

volatility3/framework/plugins/windows/shimcachemem.py

@@ -582,13 +582,19 @@ def get_module_section_range(
         :return: The offset and size of the module, if found; Otherwise, returns `None`
         """
 
-        try:
-            krnl_mod = next(
-                module
-                for module in modules.Modules.list_modules(context, kernel_module_name)
-                if module.BaseDllName.String in module_list
-            )
-        except StopIteration:
+        krnl_mod = None
+        for module in modules.Modules.list_modules(context, kernel_module_name):
+            try:
+                if module.BaseDllName.String in module_list:
+                    krnl_mod = module
+                    break
+            except exceptions.InvalidAddressException as exc:
+                vollog.warning(
+                    f"Failed to get kernel module due to {exc.__class__.__name__}: {exc.invalid_address:#x}"
+                )
+
+        if krnl_mod is None:
+            vollog.warning("Failed to find kernel module")
             return None
 
         kernel = context.modules[kernel_module_name]

volatility3/framework/symbols/windows/extensions/shimcache.py

@@ -39,37 +39,44 @@ def exec_flag(self) -> Union[bool, interfaces.renderers.BaseAbsentValue]:
         if self._exec_flag is not None:
             return self._exec_flag
 
-        if hasattr(self, "ListEntryDetail") and hasattr(
-            self.ListEntryDetail, "InsertFlags"
-        ):
-            self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2
-
-        elif hasattr(self, "InsertFlags"):
-            self._exec_flag = self.InsertFlags & 0x2 == 2
+        try:
+            if hasattr(self, "ListEntryDetail") and hasattr(
+                self.ListEntryDetail, "InsertFlags"
+            ):
+                self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2
 
-        elif hasattr(self, "ListEntryDetail") and hasattr(
-            self.ListEntryDetail, "BlobBuffer"
-        ):
-            blob_offset = self.ListEntryDetail.BlobBuffer
-            blob_size = self.ListEntryDetail.BlobSize
+            elif hasattr(self, "InsertFlags"):
+                self._exec_flag = self.InsertFlags & 0x2 == 2
 
-            if not self._context.layers[self.vol.native_layer_name].is_valid(
-                blob_offset, blob_size
+            elif hasattr(self, "ListEntryDetail") and hasattr(
+                self.ListEntryDetail, "BlobBuffer"
             ):
-                self._exec_flag = renderers.UnparsableValue()
-                return self._exec_flag
+                blob_offset = self.ListEntryDetail.BlobBuffer
+                blob_size = self.ListEntryDetail.BlobSize
 
-            raw_flag = self._context.layers[self.vol.native_layer_name].read(
-                blob_offset, blob_size
+                if not self._context.layers[self.vol.native_layer_name].is_valid(
+                    blob_offset, blob_size
+                ):
+                    self._exec_flag = renderers.UnreadableValue()
+                    return self._exec_flag
+
+                raw_flag = self._context.layers[self.vol.native_layer_name].read(
+                    blob_offset, blob_size
+                )
+                if not raw_flag:
+                    self._exec_flag = renderers.UnparsableValue()
+                    return self._exec_flag
+
+                try:
+                    self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
+                except struct.error:
+                    self._exec_flag = renderers.UnparsableValue()
+
+        except exceptions.InvalidAddressException:
+            vollog.debug(
+                "Failed to read SHIMCACHE_ENTRY exec flag due to invalid address exception"
             )
-            if not raw_flag:
-                self._exec_flag = renderers.UnparsableValue()
-                return self._exec_flag
-
-            try:
-                self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
-            except struct.error:
-                self._exec_flag = renderers.UnparsableValue()
+            self._exec_flag = renderers.UnreadableValue()
 
         else:
             # Always set to true for XP/2K3