Skip to content

Commit e9a4ea1

Browse files
committed
Fix traceback in volshell's dt()
A `SymbolError` can occur when a type contains a pointer to an opaque type. For example, `_EPROCESS` can have a member that points to an `_EPROCESS_QUOTA_BLOCK`, but there is no definition for that type, so its size and readability can't be determined. This wraps the block in a try/except, and reports that the type has an unknown size in the suffix if a `SymbolError` occurs.
1 parent b3d1ce3 commit e9a4ea1

File tree

1 file changed

+9
-6
lines changed

1 file changed

+9
-6
lines changed

volatility3/cli/volshell/generic.py

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -621,12 +621,15 @@ def _display_value(self, value: Any) -> str:
621621
if isinstance(value, objects.Pointer):
622622
# show pointers in hex to match output for struct addrs
623623
# highlight null or unreadable pointers
624-
if value == 0:
625-
suffix = " (null pointer)"
626-
elif not value.is_readable():
627-
suffix = " (unreadable pointer)"
628-
else:
629-
suffix = ""
624+
try:
625+
if value == 0:
626+
suffix = " (null pointer)"
627+
elif not value.is_readable():
628+
suffix = " (unreadable pointer)"
629+
else:
630+
suffix = ""
631+
except exceptions.SymbolError as exc:
632+
suffix = f" (pointer to {exc.symbol_name} - unknown size)"
630633
return f"{hex(value)}{suffix}"
631634
elif isinstance(value, objects.PrimitiveObject):
632635
return repr(value)

0 commit comments

Comments
 (0)