From 51bce3e62049155b88feb6459b3a75bd1dcdffd7 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 00:25:13 +0900 Subject: [PATCH 1/2] Fix: compare logic for key_path and top_key --- volatility3/plugins/windows/registry/certificates.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 96a7e3977..5bc2b18e3 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -6,7 +6,6 @@ from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey - class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" @@ -52,7 +51,7 @@ class Certificates(interfaces.plugins.PluginInterface): node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) - unique_key_offset = key_path.index(top_key) + len(top_key) + 1 + unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1 reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)] key_hash = key_path[key_path.rindex("\\") + 1:] From fa6465dcfb05c3d3f63f3903d5d062eda3ddc131 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 00:26:39 +0900 Subject: [PATCH 2/2] Revert: blank line --- volatility3/plugins/windows/registry/certificates.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 5bc2b18e3..91f17fb2d 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -6,6 +6,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey + class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store."""