From 665db0017e9baab274e5a1f2b4c2919116a4f156 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 May 2018 18:02:48 +0100 Subject: [PATCH] Don't count the volatile bit when checking things are outside the hive maximum address. --- volatility/framework/symbols/windows/extensions/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index 072e0447d..798cfb54e 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -72,7 +72,7 @@ class _CM_KEY_NODE(objects.Struct): # We could change the array type to a struct with both parts subkey_node.List.count = subkey_node.Count * 2 for key_offset in subkey_node.List[::2]: - if key_offset < hive.maximum_address: + if (key_offset & 0x7fffffff) < hive.maximum_address: node = hive.get_node(key_offset) if node.vol.type_name.endswith(constants.BANG + "_CM_KEY_INDEX"): signature = node.cast('string', max_length = 2, encoding = 'latin-1')