From 317c1cdb7b75e3df362b5d9aa95b1363fa9ccf8a Mon Sep 17 00:00:00 2001 From: superponible Date: Sat, 3 Aug 2019 17:23:59 -0500 Subject: [PATCH] store cmhive name instead of _cmhive --- volatility/framework/layers/registry.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 6f9b1d502..01d552f5b 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -55,10 +55,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._reg_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'registry') - self._cmhive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer, - self._hive_offset) - - self.hive = self._cmhive.Hive + cmhive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer, + self._hive_offset) + self._cmhive_name = cmhive.get_name() + self.hive = cmhive.Hive # TODO: Check the checksum if self.hive.Signature != 0xbee0bee0: @@ -94,7 +94,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): return self._maxaddr_volatile if volatile else self._maxaddr_non_volatile def get_name(self) -> str: - return self._cmhive.get_name() or "[NONAME]" + return self._cmhive_name or "[NONAME]" @property def hive_offset(self) -> int: