AttributeError: 'NoneType' object has no attribute 'decode'
Closed this issue · 0 comments
dhondta commented
I experienced the following bug using your plugin:
$ volatility editbox -f [...] --profile=[...] -p [...] --dump-dir [...]
Volatility Foundation Volatility Framework 2.6
******************************
[...]
Traceback (most recent call last):
File "/usr/bin/volatility", line 192, in <module>
main()
File "/usr/bin/volatility", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility-2.6-py2.7.egg/volatility/commands.py", line 147, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.6-py2.7.egg/volatility/plugins/gui/editbox.py", line 462, in render_text
ctrl.dump_meta(outfd)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.6-py2.7.egg/volatility/plugins/gui/editbox.py", line 224, in dump_meta
outfd.write('undoBuf : {}\n'.format(self.get_undo(no_crlf=True)))
File "/usr/local/lib/python2.7/dist-packages/volatility-2.6-py2.7.egg/volatility/plugins/gui/editbox.py", line 200, in get_undo
return self.obj_vm.read(self.undoBuf, self.undoLen * 2).decode('utf-16').replace('\r\n', '.')
AttributeError: 'NoneType' object has no attribute 'decode'
Offending lines: 199 to 202
if no_crlf:
return self.obj_vm.read(self.undoBuf, self.undoLen * 2).decode('utf-16').replace('\r\n', '.')
else:
return self.obj_vm.read(self.undoBuf, self.undoLen * 2).decode('utf-16')
It seems that, in some cases, self.obj_vm.read(self.undoBuf, self.undoLen * 2)
is None
and therefore causes the error while the plugin could complete.
Proposed fix:
r = self.obj_vm.read(self.undoBuf, self.undoLen * 2)
if r is not None:
r = r.decode('utf-16')
return r.replace('\r\n', '.') if no_crlf else r