Merge pull request #1217 from eve-mem/windows_issue_1146

Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
volatilityfoundation · Jul 30, 2024 · 4e8d64e · 4e8d64e
2 parents bee3339 + 799afe6
commit 4e8d64e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py
@@ -177,7 +177,7 @@ def find_sar_value(self):
                 )
             except exceptions.InvalidAddressException:
                 vollog.warning(
-                    f"Failed to read {hex(num_bytes_to_read)} bytes at symbol {hex(func_addr_to_read)}. Unable to decode SAR value. Failing back to a common value of 0x10"
+                    f"Failed to read {hex(num_bytes_to_read)} bytes at symbol {hex(func_addr_to_read)}. Unable to decode SAR value. Failing back to a common value of {hex(DEFAULT_SAR_VALUE)}"
                 )
                 self._sar_value = DEFAULT_SAR_VALUE
                 return self._sar_value
@@ -201,7 +201,7 @@ def find_sar_value(self):
 
             if self._sar_value is None:
                 vollog.warning(
-                    f"Failed to to locate SAR value having parsed {instruction_count} instructions, failing back to a common value of 0x10"
+                    f"Failed to to locate SAR value having parsed {instruction_count} instructions, failing back to a common value of {hex(DEFAULT_SAR_VALUE)}"
                 )
                 self._sar_value = DEFAULT_SAR_VALUE