WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-02 05:08:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: compare logic for key_path and top_key

Browse Source
This commit is contained in:
Donghyun Kim
2022-05-12 00:25:13 +09:00
parent 7ca62d0bfe
commit 51bce3e620
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/plugins/windows/registry/certificates.py
+1 -2
View File
@@ -6,7 +6,6 @@ from volatility3.framework.configuration import requirements
from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes
from volatility3.plugins.windows.registry import hivelist, printkey
class Certificates(interfaces.plugins.PluginInterface):
"""Lists the certificates in the registry's Certificate Store."""
@@ -52,7 +51,7 @@ class Certificates(interfaces.plugins.PluginInterface):
node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True):
if not is_key and RegValueTypes(node.Type).name == "REG_BINARY":
name, certificate_data = self.parse_data(node.decode_data())
unique_key_offset = key_path.index(top_key) + len(top_key) + 1
unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1
reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]
key_hash = key_path[key_path.rindex("\\") + 1:]