handles backtrace

[gleeda]

Traceback (most recent call last):
  File "vol.py", line 192, in <module>
    main()
  File "vol.py", line 183, in main
    command.execute()
  File "volatility/volatility/commands.py", line 127, in execute
    func(outfd, data)
  File "volatility/volatility/plugins/handles.py", line 67, in render_text
    self.table_row(outfd, offset, pid, handle.HandleValue, handle.GrantedAccess, object_type, name)
  File "volatility/volatility/commands.py", line 217, in table_row
    result = self._elide(("{0:" + spec.to_string() + "}").format(args[index]), spec.minwidth)
UnicodeEncodeError: 'ascii' codec can't encode character u'\ufffd' in position 0: ordinal not in range(128)

[gleeda]

problem is an invalid character in object_type (encoded in utf8 so it wouldn't fail below):

0xfffffadf99d28fe0    468             0x29e0           0x100003 � 

There are a couple of things we can do, like:

diff --git a/volatility/plugins/overlays/windows/windows.py b/volatility/plugins/overlays/windows/windows.py
index 96d2ce0..0374bb9 100644
--- a/volatility/plugins/overlays/windows/windows.py
+++ b/volatility/plugins/overlays/windows/windows.py
@@ -846,7 +846,7 @@ class _OBJECT_HEADER(obj.CType):
         """Return the object's type as a string"""
         type_obj = obj.Object("_OBJECT_TYPE", self.Type, self.obj_native_vm)

-        return type_obj.Name.v()
+        return str(type_obj.Name or '') 

     def is_valid(self):
         if not obj.CType.is_valid(self):

or

diff --git a/volatility/plugins/overlays/windows/windows.py b/volatility/plugins/overlays/windows/windows.py
index 96d2ce0..0374bb9 100644
--- a/volatility/plugins/overlays/windows/windows.py
+++ b/volatility/plugins/overlays/windows/windows.py
@@ -846,7 +846,7 @@ class _OBJECT_HEADER(obj.CType):
         """Return the object's type as a string"""
         type_obj = obj.Object("_OBJECT_TYPE", self.Type, self.obj_native_vm)

-        return type_obj.Name.v()
+        return type_obj.Name.v().encode("ascii", "replace")

     def is_valid(self):
         if not obj.CType.is_valid(self):

They both give off: "?" instead of the offending character.... which do we prefer? The first method is used in a lot of other places.