WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Comment out the HBIN size check for now

Browse Source 
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
This commit is contained in:
Mike Auty
2018-05-21 22:57:10 +01:00
parent 665db0017e
commit 347b4854ff
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/registry.py
+4 -2
View File
@@ -190,8 +190,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
hbin_offset = hbin_offset - 0x1000
hbin = self.context.object(self._reg_table_name + constants.BANG + "_HBIN",
offset = hbin_offset, layer_name = self._base_layer)
if translated_offset + length > hbin_offset + hbin.Size:
raise RegistryFormatException("Cell address outside expected HBIN")
# FIXME: Why this check fails when everything else runs fine
# if translated_offset + length > hbin_offset + hbin.Size and hbin.Size > 0:
# raise RegistryFormatException("Cell address {} outside expected HBIN limit: {}".format(
# hex(translated_offset + length), hex(hbin_offset + hbin.Size)))
response.append((offset, translated_offset, length, self._base_layer))
length -= length
return response