From 9cc73b6a0388321ee6de9f6c82a124e263282d78 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 12 Oct 2023 09:57:24 -0500 Subject: [PATCH 1/2] issue #1017 - check for valid root node type --- volatility3/framework/layers/registry.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index cc8ce1f4c..a2d3b0fd4 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -171,7 +171,12 @@ class RegistryHive(linear.LinearlyMappedLayer): node (default) or a list of nodes from root to the current node (if return_list is true). """ - node_key = [self.get_node(self.root_cell_offset)] + root_node = self.get_node(self.root_cell_offset) + if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"): + raise RegistryFormatException( + self.name, "Encountered {} instead of _CM_KEY_NODE".format(root_node.vol.type_name) + ) + node_key = [root_node] if key.endswith("\\"): key = key[:-1] key_array = key.split("\\") From fcaba2d95a79a7bec70cde265199ab892b6c0948 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 18 Oct 2023 14:08:50 -0500 Subject: [PATCH 2/2] issue #1017 - black updates --- volatility3/framework/layers/registry.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index a2d3b0fd4..9841d2bb0 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -174,7 +174,10 @@ class RegistryHive(linear.LinearlyMappedLayer): root_node = self.get_node(self.root_cell_offset) if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"): raise RegistryFormatException( - self.name, "Encountered {} instead of _CM_KEY_NODE".format(root_node.vol.type_name) + self.name, + "Encountered {} instead of _CM_KEY_NODE".format( + root_node.vol.type_name + ), ) node_key = [root_node] if key.endswith("\\"):