diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index c633bcfa3..7a59efd98 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -193,4 +193,4 @@ class _CM_KEY_VALUE(objects.Struct): # Fall back if it's something weird vollog.debug("Unknown registry value type encountered: {}".format(self.Type)) - return self.Data.cast("string", max_length = self.DataLength, encoding = "latin-1") + return self.Data.cast("string", max_length = datalen, encoding = "latin-1")