Skip to content

Commit d13cf7a

Browse files
authored
Merge pull request #1681 from volatilityfoundation/fix_dos_reconstruct_calls
Fix error handling and reporting around PE reconstruction calls
2 parents 5a71511 + 0d3b155 commit d13cf7a

File tree

3 files changed

+23
-6
lines changed

3 files changed

+23
-6
lines changed

volatility3/framework/plugins/windows/iat.py

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,23 @@ def _generator(self, procs):
6969
layer_name=proc_layer_name,
7070
)
7171

72-
for offset, data in dos_header.reconstruct():
73-
pe_data.seek(offset)
74-
pe_data.write(data)
72+
try:
73+
for offset, data in dos_header.reconstruct():
74+
pe_data.seek(offset)
75+
pe_data.write(data)
76+
except (exceptions.InvalidAddressException, ValueError) as excp:
77+
vollog.warning(
78+
f"Exception triggered when reconstructing PE file for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Output file may be corrupt and/or truncated."
79+
)
80+
81+
try:
82+
pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True)
83+
except pefile.PEFormatError as excp:
84+
vollog.debug(
85+
f"Exception triggered when creating PE file object for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Unable to extract file."
86+
)
87+
continue
7588

76-
pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True)
7789
pe_obj.parse_data_directories(
7890
[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"]]
7991
)

volatility3/framework/plugins/windows/pe_symbols.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ def get_pefile_obj(
327327

328328
pe_ret = pefile.PE(data=pe_data.getvalue(), fast_load=True)
329329

330-
except exceptions.InvalidAddressException:
330+
except (exceptions.InvalidAddressException, ValueError):
331331
pe_ret = None
332332

333333
return pe_ret

volatility3/framework/plugins/windows/verinfo.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,12 @@ def _generator(
176176
(major, minor, product, build) = self.get_version_information(
177177
self._context, pe_table_name, session_layer_name, mod.DllBase
178178
)
179-
except (exceptions.InvalidAddressException, TypeError, AttributeError):
179+
except (
180+
exceptions.InvalidAddressException,
181+
ValueError,
182+
TypeError,
183+
AttributeError,
184+
):
180185
(major, minor, product, build) = [renderers.UnreadableValue()] * 4
181186
if (
182187
not isinstance(BaseDllName, renderers.UnreadableValue)

0 commit comments

Comments
 (0)