WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 19:29:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

issue 528 - change how registry enum members are accessed

Browse Source
This commit is contained in:
superponible
2021-07-12 11:40:30 -05:00
parent 7f6378fd5d
commit 446510ab5f
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/getsids.py
+2 -2
View File
@@ -96,9 +96,9 @@ class GetSIDs(interfaces.plugins.PluginInterface):
value_data = node.decode_data()
if isinstance(value_data, int):
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8')
elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_BINARY:
elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_BINARY:
value_data = format_hints.MultiTypeData(value_data, show_hex = True)
elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_MULTI_SZ:
elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_MULTI_SZ:
value_data = format_hints.MultiTypeData(value_data,
encoding = 'utf-16-le',
split_nulls = True)
volatility3/framework/plugins/windows/registry/printkey.py
+3 -3
View File
@@ -123,7 +123,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
value_node_name = renderers.UnreadableValue()
try:
value_type = RegValueTypes.get(node.Type).name
value_type = RegValueTypes[node.Type].name
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.debug(excp)
value_type = renderers.UnreadableValue()
@@ -137,9 +137,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
if isinstance(value_data, int):
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8')
elif RegValueTypes.get(node.Type) == RegValueTypes.REG_BINARY:
elif RegValueTypes[node.Type] == RegValueTypes.REG_BINARY:
value_data = format_hints.MultiTypeData(value_data, show_hex = True)
elif RegValueTypes.get(node.Type) == RegValueTypes.REG_MULTI_SZ:
elif RegValueTypes[node.Type] == RegValueTypes.REG_MULTI_SZ:
value_data = format_hints.MultiTypeData(value_data,
encoding = 'utf-16-le',
split_nulls = True)
volatility3/plugins/windows/registry/certificates.py
+1 -1
View File
@@ -50,7 +50,7 @@ class Certificates(interfaces.plugins.PluginInterface):
node_path = hive.get_key(top_key, return_list = True)
for (depth, is_key, last_write_time, key_path, volatility,
node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True):
if not is_key and RegValueTypes.get(node.Type).name == "REG_BINARY":
if not is_key and RegValueTypes[node.Type].name == "REG_BINARY":
name, certificate_data = self.parse_data(node.decode_data())
unique_key_offset = key_path.index(top_key) + len(top_key) + 1
reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]