Ensure we appropriately truncate unicode strings.

volatility/framework/layers/registry.py

@@ -91,11 +91,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         if key.endswith("\\"):
             key = key[:-1]
         key_array = key.split('\\')
-        depth = 0
         found_key = []
-        while len(key_array) > 1 and node_key:
+        while key_array and node_key:
             for subkey in node_key.get_subkeys():
-                if subkey.keyname == key_array[depth]:
+                if subkey.helper_name == key_array[0]:
                     node_key = subkey
                     found_key, key_array = found_key + [key_array[0]], key_array[1:]
                     break

volatility/framework/symbols/windows/extensions/registry.py

@@ -142,7 +142,11 @@ class _CM_KEY_VALUE(objects.Struct):
                 raise ValueError("Size of data does not match the type of registry value {}".format(self.helper_name))
             return struct.unpack("<Q", data)[0]
         if self_type in [RegValueTypes.REG_SZ, RegValueTypes.REG_EXPAND_SZ, RegValueTypes.REG_LINK]:
-            return str(data, encoding = "utf-16-le")
+            # truncate after \x00\x00 to ensure it can
+            output = str(data, encoding = "utf-16-le", errors = 'replace')
+            if output.find("\x00") > 0:
+                output = output[:output.find("\x00")]
+            return output
         if self_type == RegValueTypes.REG_MULTI_SZ:
             return str(data, encoding = "utf-16-le").split("\x00")
         if self_type == RegValueTypes.REG_BINARY: