From 347b4854ff8c5edf2e8f2f921c6e1e7cc7fea429 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 May 2018 22:57:10 +0100 Subject: [PATCH] Comment out the HBIN size check for now Leave a comment to ensure we get back to checking out why the hbin size check fails to only prevent bad accesses (and effectively gives false positives). --- volatility/framework/layers/registry.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 4d15bd34b..a93944ce8 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -190,8 +190,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): hbin_offset = hbin_offset - 0x1000 hbin = self.context.object(self._reg_table_name + constants.BANG + "_HBIN", offset = hbin_offset, layer_name = self._base_layer) - if translated_offset + length > hbin_offset + hbin.Size: - raise RegistryFormatException("Cell address outside expected HBIN") + # FIXME: Why this check fails when everything else runs fine + # if translated_offset + length > hbin_offset + hbin.Size and hbin.Size > 0: + # raise RegistryFormatException("Cell address {} outside expected HBIN limit: {}".format( + # hex(translated_offset + length), hex(hbin_offset + hbin.Size))) response.append((offset, translated_offset, length, self._base_layer)) length -= length return response