fixed issues

volatility/framework/plugins/windows/cachedump.py

@@ -81,7 +81,7 @@ class Cachedump(interfaces.plugins.PluginInterface):
     def _generator(self, syshive, sechive):
         bootkey = hashdump.Hashdump.get_bootkey(syshive)
         if not bootkey:
-            raise Exception('Unable to find bootkey')
+            raise ValueError('Unable to find bootkey')
         
         is_vista_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (6, 0),
                                                      fallback_checks = [("KdCopyDataBlock", None, True)])
@@ -89,15 +89,15 @@ class Cachedump(interfaces.plugins.PluginInterface):
 
         lsakey = lsadump.Lsadump.get_lsa_key(sechive, bootkey, vista_or_later)
         if not lsakey:
-            raise Exception('Unable to find lsa key') 
+            raise ValueError('Unable to find lsa key') 
 
         nlkm = self.get_nlkm(sechive, lsakey, vista_or_later)
         if not nlkm:
-            raise Exception('Unable to find nlkma key') 
+            raise ValueError('Unable to find nlkma key') 
 
         cache = sechive.get_key("Cache")
         if not cache:
-            raise Exception('Unable to find cache key') 
+            raise ValueError('Unable to find cache key') 
         
 
         for cache_item in cache.get_values():

volatility/framework/plugins/windows/hashdump.py

@@ -277,7 +277,7 @@ class Hashdump(interfaces.plugins.PluginInterface):
                     rid = int(str(user.get_name()), 16)
                     yield (0, (name, rid, lmout, ntout))
         else:
-            raise Exception("Hbootkey is not valid")
+            raise ValueError("Hbootkey is not valid")
 
     def run(self):
         offset = self.config.get('offset', None)

volatility/framework/plugins/windows/lsadump.py

@@ -94,7 +94,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
         try:
             enc_secret_key = sechive.get_key("Policy\\Secrets\\" + name + "\\CurrVal")
         except KeyError:
-            raise Exception("Unable to read cache from memory")
+            raise ValueError("Unable to read cache from memory")
             
 
         enc_secret_value = next(enc_secret_key.get_values())
@@ -118,7 +118,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
 
         Decrypts a block of data with DES using given key.
         Note that key can be longer than 7 bytes."""
-        decrypted_data = ''
+        decrypted_data = b''
         j = 0   # key index
 
         for i in range(0, len(secret), 8):
@@ -145,14 +145,14 @@ class Lsadump(interfaces.plugins.PluginInterface):
         bootkey = hashdump.Hashdump.get_bootkey(syshive)
         lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later)
         if not bootkey:
-            raise Exception('Unable to find bootkey')
+            raise ValueError('Unable to find bootkey')
         
         if not lsakey:
-            raise Exception('Unable to find lsa key')
+            raise ValueError('Unable to find lsa key')
 
         secrets_key = sechive.get_key('Policy\\Secrets')
         if not secrets_key:
-            raise Exception('Unable to find secrets key')
+            raise ValueError('Unable to find secrets key')
 
         for key in secrets_key.get_subkeys():
 
@@ -171,10 +171,10 @@ class Lsadump(interfaces.plugins.PluginInterface):
             if not vista_or_later:
                 secret = self.decrypt_secret(enc_secret[0xC:], lsakey)
             else:
-                secret = self.decrypt_aes(enc_secret, lsakey).decode('latin1')
+                secret = self.decrypt_aes(enc_secret, lsakey)
 
 
-            yield (0,(key.get_name()+'\n', secret+'\n', secret.encode('latin1')))
+            yield (0,(key.get_name(), secret.decode('latin1'), secret))
 
 
 

volatility/framework/symbols/linux/extensions/elf.py

@@ -2,27 +2,13 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-<<<<<<< HEAD
 from typing import Dict, Tuple
-
 from volatility.framework import constants
 from volatility.framework import objects, interfaces
-=======
-from volatility.framework import exceptions, constants
-from volatility.framework import objects, interfaces
-from volatility.framework.objects import utility
-from volatility.framework.renderers import conversion
-from typing import Any, Dict, List, Optional, Tuple, Union, Type
->>>>>>> added hashdump
-
 
 class elf(objects.StructType):
     '''
-<<<<<<< HEAD
     Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`,
-=======
-    Class used to create elf objects. It overrides the typename to Elf32_ or Elf64_, 
->>>>>>> added hashdump
     depending on the corresponding value on e_ident
     '''
 
@@ -57,11 +43,7 @@ class elf(objects.StructType):
         elif ei_class == 2:
             self._type_prefix = "Elf64_"
         else:
-<<<<<<< HEAD
             raise ValueError("Unsupported ei_class value {}".format(ei_class))
-=======
-            self._type_prefix = None
->>>>>>> added hashdump
 
         # Construct the full header
         self._hdr = self._context.object(symbol_table_name + constants.BANG + self._type_prefix + "Ehdr",