From 3d7b2a520b7d41d575376a7f9057f04ad09593cf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 1 Sep 2019 16:05:51 +0100 Subject: [PATCH] Ensure the tree output for printkey doesn't jump into deep layers. --- volatility/framework/plugins/windows/registry/printkey.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 9254ec05d..cf1330103 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -130,7 +130,8 @@ class PrintKey(interfaces.plugins.PluginInterface): node_path = hive.get_key(key, return_list = True) else: node_path = [hive.get_node(hive.root_cell_offset)] - yield from self.hive_walker(hive, node_path, recurse = self.config.get('recurse', None)) + for (x, y) in self.hive_walker(hive, node_path, recurse = self.config.get('recurse', None)): + yield (x - len(node_path), y) except (exceptions.InvalidAddressException, KeyError, RegistryFormatException) as excp: if type(excp) == KeyError: