From 689756dc9aeff777bf83e06024fd7a149d02fcd5 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 20 May 2018 23:25:20 +0100
Subject: [PATCH] Deal with NULL base blocks in the registry code.

---
 volatility/framework/layers/registry.py | 10 +++++-----
 volatility/plugins/windows/printkey.py  | 22 +++++++++++++---------
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index 135dffc42..4d15bd34b 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -46,11 +46,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         self._base_block = self.hive.BaseBlock.dereference()
 
         self._minaddr = 0
-        self._maxaddr = self._base_block.Length
-
-        if self._base_block.Length <= 0:
-            raise exceptions.StructureException(
-                "Invalid registry base_block length: {}".format(self._base_block.Length))
+        # If there's no base_block, we don't know how big the address space is
+        # We also don't know the root_cell_offset, so we use a hardcoded value of 0x20
+        self._maxaddr = self._base_block.Length or 0xffffffff
 
     @property
     def hive_offset(self) -> int:
@@ -64,6 +62,8 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
     @property
     def root_cell_offset(self) -> int:
         """Returns the offset for the root cell in this hive"""
+        if self._base_block.Length <= 0:
+            return 0x20
         return self._base_block.RootCell
 
     def get_cell(self, cell_offset: int) -> 'objects.Struct':
diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py
index e345fef64..ed6b2d6a9 100644
--- a/volatility/plugins/windows/printkey.py
+++ b/volatility/plugins/windows/printkey.py
@@ -3,7 +3,7 @@ import logging
 import typing
 
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import objects, renderers
+from volatility.framework import objects, renderers, exceptions
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
 from volatility.framework.objects import utility
@@ -98,15 +98,19 @@ class PrintKey(plugins.PluginInterface):
             reg_config_path = self.make_subconfig(hive_offset = hive_offset,
                                                   base_layer = self.config['primary'],
                                                   nt_symbols = self.config['nt_symbols'])
-            hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows')
-            self.context.memory.add_layer(hive)
+            try:
+                hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
+                self.context.memory.add_layer(hive)
 
-            # Walk it
-            if 'key' in self.config:
-                node_path = hive.get_key(self.config['key'], return_list = True)
-            else:
-                node_path = [hive.get_node(hive.root_cell_offset)]
-            yield from self.hive_walker(hive, node_path)
+                # Walk it
+                if 'key' in self.config:
+                    node_path = hive.get_key(self.config['key'], return_list = True)
+                else:
+                    node_path = [hive.get_node(hive.root_cell_offset)]
+                yield from self.hive_walker(hive, node_path)
+            except exceptions.StructureException:
+                # This is caused when the RegistryHive has no size (BaseBlock.Length <= 0)
+                pass
 
     def run(self):