From 28036c9405d2efef2a3a0f97ec4c9eacdf4f0521 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 23 Oct 2017 17:11:15 +0100
Subject: [PATCH] Add in the ability to recurse keys (off by default).

---
 volatility/plugins/windows/printkey.py | 27 +++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py
index 215413f5b..8a3455f0d 100644
--- a/volatility/plugins/windows/printkey.py
+++ b/volatility/plugins/windows/printkey.py
@@ -25,7 +25,11 @@ class PrintKey(plugins.PluginInterface):
                 requirements.StringRequirement(name = 'key',
                                                description = "Key to start from",
                                                default = None,
-                                               optional = True)]
+                                               optional = True),
+                requirements.BooleanRequirement(name = 'recurse',
+                                                description = 'Recurses through keys',
+                                                default = False,
+                                                optional = True)]
 
     def update_configuration(self):
         """No operation since all values provided by config/requirements initially"""
@@ -37,17 +41,29 @@ class PrintKey(plugins.PluginInterface):
         unix_time = node.LastWriteTime.QuadPart // 10000000
         unix_time = unix_time - 11644473600
 
+        for key_node in node.get_subkeys():
+            result = (key_path.count("\\"),
+                      (key_path,
+                       str(datetime.datetime.utcfromtimestamp(unix_time)),
+                       "Key",
+                       key_node.helper_name,
+                       "",
+                       key_node.volatile))
+            yield result
+
         for value_node in node.get_values():
             result = (key_path.count("\\"),
                       (key_path,
                        str(datetime.datetime.utcfromtimestamp(unix_time)),
                        RegValueTypes(value_node.Type).name,
                        value_node.helper_name,
-                       str(value_node.decode_data())))
+                       str(value_node.decode_data()),
+                       node.volatile))
             yield result
 
-        for node in node.get_subkeys():
-            yield from self.registry_walker(registry, node)
+        if self.config['recurse']:
+            for node in node.get_subkeys():
+                yield from self.registry_walker(registry, node)
 
     def run(self):
         layer = self.context.memory[self.config['primary']]
@@ -68,5 +84,6 @@ class PrintKey(plugins.PluginInterface):
                                    ('Last Write Time', str),
                                    ('Type', str),
                                    ('Name', str),
-                                   ('Data', str)],
+                                   ('Data', str),
+                                   ('Volatile', bool)],
                         generator = self.registry_walker(registry_layer))