diff --git a/volatility/plugins/windows/registry/__init__.py b/volatility/plugins/windows/registry/__init__.py new file mode 100644 index 000000000..62f67f25c --- /dev/null +++ b/volatility/plugins/windows/registry/__init__.py @@ -0,0 +1 @@ +"""Windows registry plugins""" diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/registry/hivelist.py similarity index 100% rename from volatility/plugins/windows/hivelist.py rename to volatility/plugins/windows/registry/hivelist.py diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/registry/printkey.py similarity index 98% rename from volatility/plugins/windows/printkey.py rename to volatility/plugins/windows/registry/printkey.py index 204ffe2a7..935cc0d2e 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/registry/printkey.py @@ -81,7 +81,7 @@ class PrintKey(plugins.PluginInterface): """Walks through a registry, hive by hive""" if self.config.get('offset', None) is None: try: - import volatility.plugins.windows.hivelist as hivelist + import volatility.plugins.windows.registry.hivelist as hivelist hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context, self.config['primary'], self.config['nt_symbols'])] diff --git a/volatility/plugins/windows/userassist.json b/volatility/plugins/windows/registry/userassist.json similarity index 100% rename from volatility/plugins/windows/userassist.json rename to volatility/plugins/windows/registry/userassist.json diff --git a/volatility/plugins/windows/userassist.py b/volatility/plugins/windows/registry/userassist.py similarity index 99% rename from volatility/plugins/windows/userassist.py rename to volatility/plugins/windows/registry/userassist.py index d023d8df7..5d04ba7d9 100644 --- a/volatility/plugins/windows/userassist.py +++ b/volatility/plugins/windows/registry/userassist.py @@ -210,7 +210,7 @@ class UserAssist(interfaces_plugins.PluginInterface): # get all the user hive offsets or use the one specified if self.config.get('offset', None) is None: try: - import volatility.plugins.windows.hivelist as hivelist + import volatility.plugins.windows.registry.hivelist as hivelist hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(context = self.context, layer_name = self.config['primary'],