volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.72k stars 461 forks source link

`_get_boottime_raw` fails on old symbol tables, and the exception stops any further results #1361

Open ikelos opened 2 days ago

ikelos commented 2 days ago

Just so I don't forget, the new linux _get_boottime_raw handling stuff breaks with very old symbol tables (where the type of the timekeeper symbol is void). In that instance, vmlinux.has_symbol returns true, but get_object_from_symbol returns a void. The method also fires off an exception that brings the entire run to a halt (meaning no data at all, for want of a symbol table that can handle boottimes, one that used to work on the very same image). I think it should probably return None (requiring callers to check for that) and do its best to fail gracefully (or better, with a vollog.warning) if the symbol table doesn't have what it needs...

In my partial patch up I used not vmlinux.get_symbol("tk_core").type_name.endswith("!void") but I dunno how brittle that'll be? Ideally, I'd like to still get output, but I was trying to test something else, so I went to @Abyss-W4tcher 's repo (via a config file, which worked as expected, so that was nice) and got an improved symbol table for it, so haven't had time to circle back and actually get it working.

This is just a reminder to fix it up, am I ok assigning it to you @gcmoreira ? If not gimme a shout and I'll shift it, just want to make sure it gets fixed as we're intending to cut a release branch for all the plugins that got added last month soon...