From 6dc8b4d517d3751085915533544e76ebb6e7692e Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 12 Sep 2018 22:55:32 +0100
Subject: [PATCH] Create a windows.registry category.

---
 volatility/plugins/windows/registry/__init__.py           | 1 +
 volatility/plugins/windows/{ => registry}/hivelist.py     | 0
 volatility/plugins/windows/{ => registry}/printkey.py     | 2 +-
 volatility/plugins/windows/{ => registry}/userassist.json | 0
 volatility/plugins/windows/{ => registry}/userassist.py   | 2 +-
 5 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 volatility/plugins/windows/registry/__init__.py
 rename volatility/plugins/windows/{ => registry}/hivelist.py (100%)
 rename volatility/plugins/windows/{ => registry}/printkey.py (98%)
 rename volatility/plugins/windows/{ => registry}/userassist.json (100%)
 rename volatility/plugins/windows/{ => registry}/userassist.py (99%)

diff --git a/volatility/plugins/windows/registry/__init__.py b/volatility/plugins/windows/registry/__init__.py
new file mode 100644
index 000000000..62f67f25c
--- /dev/null
+++ b/volatility/plugins/windows/registry/__init__.py
@@ -0,0 +1 @@
+"""Windows registry plugins"""
diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/registry/hivelist.py
similarity index 100%
rename from volatility/plugins/windows/hivelist.py
rename to volatility/plugins/windows/registry/hivelist.py
diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/registry/printkey.py
similarity index 98%
rename from volatility/plugins/windows/printkey.py
rename to volatility/plugins/windows/registry/printkey.py
index 204ffe2a7..935cc0d2e 100644
--- a/volatility/plugins/windows/printkey.py
+++ b/volatility/plugins/windows/registry/printkey.py
@@ -81,7 +81,7 @@ class PrintKey(plugins.PluginInterface):
         """Walks through a registry, hive by hive"""
         if self.config.get('offset', None) is None:
             try:
-                import volatility.plugins.windows.hivelist as hivelist
+                import volatility.plugins.windows.registry.hivelist as hivelist
                 hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context,
                                                                                          self.config['primary'],
                                                                                          self.config['nt_symbols'])]
diff --git a/volatility/plugins/windows/userassist.json b/volatility/plugins/windows/registry/userassist.json
similarity index 100%
rename from volatility/plugins/windows/userassist.json
rename to volatility/plugins/windows/registry/userassist.json
diff --git a/volatility/plugins/windows/userassist.py b/volatility/plugins/windows/registry/userassist.py
similarity index 99%
rename from volatility/plugins/windows/userassist.py
rename to volatility/plugins/windows/registry/userassist.py
index d023d8df7..5d04ba7d9 100644
--- a/volatility/plugins/windows/userassist.py
+++ b/volatility/plugins/windows/registry/userassist.py
@@ -210,7 +210,7 @@ class UserAssist(interfaces_plugins.PluginInterface):
         # get all the user hive offsets or use the one specified
         if self.config.get('offset', None) is None:
             try:
-                import volatility.plugins.windows.hivelist as hivelist
+                import volatility.plugins.windows.registry.hivelist as hivelist
                 hive_offsets = [hive.vol.offset for hive in
                                 hivelist.HiveList.list_hives(context = self.context,
                                                              layer_name = self.config['primary'],