Merge pull request volatilityfoundation#1145 from volatilityfoundatio…

…n/handles_bad_read_check Correctly check for a failed read
eve-mem · May 9, 2024 · 1b3ba6a · 1b3ba6a
2 parents 1c4fd26 + 2b165a5
commit 1b3ba6a
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py
@@ -161,8 +161,11 @@ def find_sar_value(self):
             except exceptions.SymbolError:
                 return None
 
-            data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200)
-            if data is None:
+            try:
+                data = self.context.layers.read(
+                    virtual_layer_name, kvo + func_addr, 0x200
+                )
+            except exceptions.InvalidAddressException:
                 return None
 
             md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)