InvalidAddressException raised by windows.statistics on elf64 memory dump about volatility3 HOT 7 CLOSED

Statistics is one of our less supported plugins (it lives in volatility/plugins rather than volatility/framework/plugins because it's not seen as a core plugin, more as an example for developers to look at to write their own plugins.

Regardless, it really shouldn't be throwing InvalidAddressExceptions, I don't believe, so I'll look into it. It's liable to be a low priority issue I'm afraid though...

from volatility3.

Hiya, hopefully I've resolved this, and the statistics plugin now counts the number of unexpected invalid pages (meaning invalid addresses that weren't page faults, ie attempts to read data from the file that couldn't be read).

Please let me know whether this works or not, so know whether to keep it open or close it off... 5:)

from volatility3.

Sorry for the delay, I still encounter an issue with this one but as you said, this plugin is far less useful than the others so the priority of this issue is much lower for now I think.
I'll try again later. Can you confirm that you attempted to fix this issue on elf64-support branch ?

from volatility3.

Ah, sadly not. This was fixed in master, and the elf branch hasn't been merged yet. It's due for merge on the 3rd if that helps...

from volatility3.

Ok, I'll try again once the PR has been merged. I'll notify you when it's done.

from volatility3.

@ikelos also can be closed as merged no?

from volatility3.

Yep, thanks for the reminder! 5:) Feel free to reopen if anyone feels this hasn't been fixed...

from volatility3.