Deal with NULL base blocks in the registry code.

volatility/framework/layers/registry.py

@@ -46,11 +46,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         self._base_block = self.hive.BaseBlock.dereference()
 
         self._minaddr = 0
-        self._maxaddr = self._base_block.Length
-
-        if self._base_block.Length <= 0:
-            raise exceptions.StructureException(
-                "Invalid registry base_block length: {}".format(self._base_block.Length))
+        # If there's no base_block, we don't know how big the address space is
+        # We also don't know the root_cell_offset, so we use a hardcoded value of 0x20
+        self._maxaddr = self._base_block.Length or 0xffffffff
 
     @property
     def hive_offset(self) -> int:
@@ -64,6 +62,8 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
     @property
     def root_cell_offset(self) -> int:
         """Returns the offset for the root cell in this hive"""
+        if self._base_block.Length <= 0:
+            return 0x20
         return self._base_block.RootCell
 
     def get_cell(self, cell_offset: int) -> 'objects.Struct':

volatility/plugins/windows/printkey.py

@@ -3,7 +3,7 @@ import logging
 import typing
 
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import objects, renderers
+from volatility.framework import objects, renderers, exceptions
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
 from volatility.framework.objects import utility
@@ -98,15 +98,19 @@ class PrintKey(plugins.PluginInterface):
             reg_config_path = self.make_subconfig(hive_offset = hive_offset,
                                                   base_layer = self.config['primary'],
                                                   nt_symbols = self.config['nt_symbols'])
-            hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows')
-            self.context.memory.add_layer(hive)
+            try:
+                hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
+                self.context.memory.add_layer(hive)
 
-            # Walk it
-            if 'key' in self.config:
-                node_path = hive.get_key(self.config['key'], return_list = True)
-            else:
-                node_path = [hive.get_node(hive.root_cell_offset)]
-            yield from self.hive_walker(hive, node_path)
+                # Walk it
+                if 'key' in self.config:
+                    node_path = hive.get_key(self.config['key'], return_list = True)
+                else:
+                    node_path = [hive.get_node(hive.root_cell_offset)]
+                yield from self.hive_walker(hive, node_path)
+            except exceptions.StructureException:
+                # This is caused when the RegistryHive has no size (BaseBlock.Length <= 0)
+                pass
 
     def run(self):