Closed eve-mem closed 3 months ago
Ok, so I thought this would be a simple change to the format_hint classes and we'd just accept BaseAbsentValue types. Sadly, I wove the type checking in too tightly. The issue is that these are types, technically. So a format_hints.Hex(thing)
is the same as cast it to int(thing)
and we type check both the column type and the value. This means that replacing the type with a function that returns the type, doesn't pass the type checking, however, we can use a lambda to either wrap the value in a type or leave it as a BaseAbsentValue
. This won't fix it for all plugins, but any plugin that wants can wrap a value it's returning with HexOrAbsent
rather than Hex
(works for any of the types in format_hints
. 5:S
When format_hints parses as UnreadableValue it can throw a TypeError which stops a plugin continues.
The expected result is that the format_hints does not cause a crash, but instead allow the UnreadableValue etc through so that they are displayed in the results.
Here is a volshell example:
This is also discussed briefly here https://github.com/volatilityfoundation/volatility3/issues/591#issuecomment-2247551726