From 218b1fd37c0a75acf45cbf9447b0f17c55696b9a Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 6 Jun 2018 16:33:24 -0500 Subject: [PATCH] use masked length to extract data --- volatility/framework/symbols/windows/extensions/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index c633bcfa3..7a59efd98 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -193,4 +193,4 @@ class _CM_KEY_VALUE(objects.Struct): # Fall back if it's something weird vollog.debug("Unknown registry value type encountered: {}".format(self.Type)) - return self.Data.cast("string", max_length = self.DataLength, encoding = "latin-1") + return self.Data.cast("string", max_length = datalen, encoding = "latin-1")