From 0d12a6dbf366b4fda69cff5606ece616231b11e9 Mon Sep 17 00:00:00 2001
From: Dave Lassalle <dave@superponible.com>
Date: Wed, 22 Aug 2018 10:45:10 -0500
Subject: [PATCH] alternative to RegValueTypes enum in lieu of _missing_()

---
 .../framework/symbols/windows/extensions/registry.py      | 8 +++++++-
 volatility/plugins/windows/printkey.py                    | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py
index 4c409c57b..a34527e10 100644
--- a/volatility/framework/symbols/windows/extensions/registry.py
+++ b/volatility/framework/symbols/windows/extensions/registry.py
@@ -31,6 +31,12 @@ class RegValueTypes(enum.Enum):
     # def _missing_(cls, value):
     #     return cls(RegValueTypes.REG_UNKNOWN)
 
+    @classmethod
+    def get(cls, value):
+        try:
+            return cls(value)
+        except ValueError:
+            return cls(RegValueTypes.REG_UNKNOWN)
 
 class _HMAP_ENTRY(objects.Struct):
     def get_block_offset(self) -> int:
@@ -171,7 +177,7 @@ class _CM_KEY_VALUE(objects.Struct):
             # but the length at the start could be negative so just adding 4 to jump past it
             data = layer.read(self.Data + 4, datalen)
 
-        self_type = RegValueTypes(self.Type)
+        self_type = RegValueTypes.get(self.Type)
         if self_type == RegValueTypes.REG_DWORD:
             if len(data) != struct.calcsize("<L"):
                 raise ValueError("Size of data does not match the type of registry value {}".format(self.get_name()))
diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py
index e2fddedfb..a4798b2c0 100644
--- a/volatility/plugins/windows/printkey.py
+++ b/volatility/plugins/windows/printkey.py
@@ -65,7 +65,7 @@ class PrintKey(plugins.PluginInterface):
             result = (key_path.count("\\"),
                       (last_write_time,
                        renderers.format_hints.Hex(hive.hive_offset),
-                       RegValueTypes(value_node.Type).name,
+                       RegValueTypes.get(value_node.Type).name,
                        key_path,
                        value_node.get_name(),
                        str(value_node.decode_data()),