diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index b54f36033..e947392cb 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -91,11 +91,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): if key.endswith("\\"): key = key[:-1] key_array = key.split('\\') - depth = 0 found_key = [] - while len(key_array) > 1 and node_key: + while key_array and node_key: for subkey in node_key.get_subkeys(): - if subkey.keyname == key_array[depth]: + if subkey.helper_name == key_array[0]: node_key = subkey found_key, key_array = found_key + [key_array[0]], key_array[1:] break diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index 40ca28d17..ee086a124 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -142,7 +142,11 @@ class _CM_KEY_VALUE(objects.Struct): raise ValueError("Size of data does not match the type of registry value {}".format(self.helper_name)) return struct.unpack(" 0: + output = output[:output.find("\x00")] + return output if self_type == RegValueTypes.REG_MULTI_SZ: return str(data, encoding = "utf-16-le").split("\x00") if self_type == RegValueTypes.REG_BINARY: