Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backtrace from _PARTITION_TABLE crashing #1480

Open
atcuno opened this issue Dec 27, 2024 · 0 comments
Open

Backtrace from _PARTITION_TABLE crashing #1480

atcuno opened this issue Dec 27, 2024 · 0 comments
Assignees

Comments

@atcuno
Copy link
Contributor

atcuno commented Dec 27, 2024

It has been a while since I looked at _PARTITION_TABLE:

24-12-26 04:11:41 volatility3.framework.symbols.windows.pdbutil DEBUG    Found tcpip.pdb: 3D457883A4764628A66DCAB9D2CEF05C-1
24-12-26 04:11:41 volatility3.framework.symbols.windows.pdbutil DEBUG    Using symbol library: tcpip.pdb/3D457883A4764628A66DCAB9D2CEF05C-1


24-12-26 04:11:41 volatility3.cli DEBUG    Traceback (most recent call last):
  File "/home/ub/volatility3/volatility3/framework/symbols/__init__.py", line 198, in _weak_resolve
    return getattr(self._dict[table_name], get_function)(component_name)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/ub/volatility3/volatility3/framework/symbols/intermed.py", line 60, in _delegate_function
    return getattr(self._delegate, name)(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/ub/volatility3/volatility3/framework/symbols/intermed.py", line 808, in get_type
    return self.natives.get_type(self.name + constants.BANG + type_name)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/ub/volatility3/volatility3/framework/symbols/native.py", line 83, in get_type
    _native_type, native_format = self._native_dictionary[type_name]
                                  ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^
KeyError: '_PARTITION_TABLE'

If its really missing then we need to get a proper vollog produced instead of crashing out, or we need to add support for it.

Sample: 20220829040759.lime

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants