WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 21:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1615 from volatilityfoundation/dgmcdona/envars_unbound_locals

Browse Source 
Windows Envars: Fix unbound locals
This commit is contained in:
ikelos
2025-02-13 22:49:19 +00:00
committed by GitHub
parent 3f2a514cc2 443cfd2515
commit 575e645f4f
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/envars.py
+7 -11
View File
@@ -67,24 +67,20 @@ class Envars(interfaces.plugins.PluginInterface):
symbol_table=kernel.symbol_table_name,
hive_offsets=None,
):
sys = False
ntuser = False
## The global variables
sys = None
try:
key = hive.get_key(
sys = hive.get_key(
"CurrentControlSet\\Control\\Session Manager\\Environment"
)
sys = True
except (KeyError, registry.RegistryFormatException):
with contextlib.suppress(KeyError, registry.RegistryFormatException):
key = hive.get_key(
sys = hive.get_key(
"ControlSet001\\Control\\Session Manager\\Environment"
)
sys = True
if sys:
with contextlib.suppress(KeyError, registry.RegistryFormatException):
for node in key.get_values():
for node in sys.get_values():
try:
value_node_name = node.get_name()
if value_node_name:
@@ -99,13 +95,13 @@ class Envars(interfaces.plugins.PluginInterface):
)
continue
ntuser = None
## The user-specific variables
with contextlib.suppress(KeyError, registry.RegistryFormatException):
key = hive.get_key("Environment")
ntuser = True
ntuser = hive.get_key("Environment")
if ntuser:
with contextlib.suppress(KeyError, registry.RegistryFormatException):
for node in key.get_values():
for node in ntuser.get_values():
try:
value_node_name = node.get_name()
if value_node_name: