From 446510ab5fc952bcffb3d5adb7f020e3da231ec8 Mon Sep 17 00:00:00 2001 From: superponible Date: Mon, 12 Jul 2021 11:40:30 -0500 Subject: [PATCH] issue 528 - change how registry enum members are accessed --- volatility3/framework/plugins/windows/getsids.py | 4 ++-- volatility3/framework/plugins/windows/registry/printkey.py | 6 +++--- volatility3/plugins/windows/registry/certificates.py | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 30503b2bf..a33a30e58 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -96,9 +96,9 @@ class GetSIDs(interfaces.plugins.PluginInterface): value_data = node.decode_data() if isinstance(value_data, int): value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8') - elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_BINARY: + elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_BINARY: value_data = format_hints.MultiTypeData(value_data, show_hex = True) - elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_MULTI_SZ: + elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_MULTI_SZ: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le', split_nulls = True) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 5b0a909fc..4c90e08b5 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -123,7 +123,7 @@ class PrintKey(interfaces.plugins.PluginInterface): value_node_name = renderers.UnreadableValue() try: - value_type = RegValueTypes.get(node.Type).name + value_type = RegValueTypes[node.Type].name except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(excp) value_type = renderers.UnreadableValue() @@ -137,9 +137,9 @@ class PrintKey(interfaces.plugins.PluginInterface): if isinstance(value_data, int): value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8') - elif RegValueTypes.get(node.Type) == RegValueTypes.REG_BINARY: + elif RegValueTypes[node.Type] == RegValueTypes.REG_BINARY: value_data = format_hints.MultiTypeData(value_data, show_hex = True) - elif RegValueTypes.get(node.Type) == RegValueTypes.REG_MULTI_SZ: + elif RegValueTypes[node.Type] == RegValueTypes.REG_MULTI_SZ: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le', split_nulls = True) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 909e852fb..c4ae0bf37 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -50,7 +50,7 @@ class Certificates(interfaces.plugins.PluginInterface): node_path = hive.get_key(top_key, return_list = True) for (depth, is_key, last_write_time, key_path, volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): - if not is_key and RegValueTypes.get(node.Type).name == "REG_BINARY": + if not is_key and RegValueTypes[node.Type].name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.index(top_key) + len(top_key) + 1 reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]