volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.72k stars 463 forks source link

format_hints throws TypeError when using UnreadableValue #1216

Closed eve-mem closed 3 months ago

eve-mem commented 4 months ago

When format_hints parses as UnreadableValue it can throw a TypeError which stops a plugin continues.

The expected result is that the format_hints does not cause a crash, but instead allow the UnreadableValue etc through so that they are displayed in the results.

Here is a volshell example:

(primary) >>> from volatility3.framework.renderers import format_hints, UnreadableValue
(primary) >>> offset = UnreadableValue()
(primary) >>> format_hints.Hex(offset) 
Traceback (most recent call last):
  File "<console>", line 1, in <module>
TypeError: int() argument must be a string, a bytes-like object or a real number, not 'UnreadableValue'
(primary) >>> offset = 1
(primary) >>> format_hints.Hex(offset)
1

This is also discussed briefly here https://github.com/volatilityfoundation/volatility3/issues/591#issuecomment-2247551726

ikelos commented 4 months ago

Ok, so I thought this would be a simple change to the format_hint classes and we'd just accept BaseAbsentValue types. Sadly, I wove the type checking in too tightly. The issue is that these are types, technically. So a format_hints.Hex(thing) is the same as cast it to int(thing) and we type check both the column type and the value. This means that replacing the type with a function that returns the type, doesn't pass the type checking, however, we can use a lambda to either wrap the value in a type or leave it as a BaseAbsentValue. This won't fix it for all plugins, but any plugin that wants can wrap a value it's returning with HexOrAbsent rather than Hex (works for any of the types in format_hints. 5:S