Shuffle around registry extensions.

volatility/framework/symbols/windows/__init__.py

@@ -1,7 +1,4 @@
-import typing
-
 from volatility.framework import interfaces
-from volatility.framework.configuration import requirements
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.windows import extensions
 from volatility.framework.symbols.windows.extensions import registry
@@ -25,7 +22,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('_OBJECT_HEADER', extensions._OBJECT_HEADER)
         self.set_type_class('_FILE_OBJECT', extensions._FILE_OBJECT)
         self.set_type_class('_DEVICE_OBJECT', extensions._DEVICE_OBJECT)
-        self.set_type_class('_CM_KEY_BODY', extensions._CM_KEY_BODY)
+        self.set_type_class('_CM_KEY_BODY', registry._CM_KEY_BODY)
         self.set_type_class('_CMHIVE', registry._CMHIVE)
         self.set_type_class('_CM_KEY_NODE', registry._CM_KEY_NODE)
         self.set_type_class('_CM_KEY_VALUE', registry._CM_KEY_VALUE)

volatility/framework/symbols/windows/extensions/__init__.py

@@ -8,7 +8,6 @@ from volatility.framework import constants, exceptions, interfaces, objects, ren
 from volatility.framework.layers import intel
 from volatility.framework.renderers import conversion
 from volatility.framework.symbols import generic
-from volatility.framework.symbols.windows.extensions.registry import RegKeyFlags
 
 vollog = logging.getLogger(__name__)
 
@@ -405,40 +404,6 @@ class ExecutiveObject(interfaces.objects.ObjectInterface):
                                     native_layer_name = self.vol.native_layer_name)
 
 
-class _CM_KEY_BODY(objects.Struct):
-    """This represents an open handle to a registry key and
-    is not tied to the registry hive file format on disk."""
-
-    def _skip_key_hive_entry_path(self, kcb_flags):
-        """Win10 14393 introduced an extra path element that it skips
-        over by checking for Flags that contain KEY_HIVE_ENTRY"""
-
-        # _CM_KEY_BODY.Trans introduced in Win10 14393
-        if hasattr(self, "Trans") and RegKeyFlags.KEY_HIVE_ENTRY & kcb_flags == RegKeyFlags.KEY_HIVE_ENTRY:
-            return True
-
-        return False
-
-    def get_full_key_name(self) -> str:
-        output = []
-        kcb = self.KeyControlBlock
-        while kcb.ParentKcb:
-            if kcb.NameBlock.Name == None:
-                break
-
-            if self._skip_key_hive_entry_path(kcb.Flags):
-                kcb = kcb.ParentKcb
-                if not kcb:
-                    break
-
-            output.append(kcb.NameBlock.Name.cast("string",
-                                                  encoding = "utf8",
-                                                  max_length = kcb.NameBlock.NameLength,
-                                                  errors = "replace"))
-            kcb = kcb.ParentKcb
-        return "\\".join(reversed(output))
-
-
 class _DEVICE_OBJECT(objects.Struct, ExecutiveObject):
     """A class for kernel device objects."""
 

volatility/framework/symbols/windows/extensions/registry.py

@@ -41,6 +41,7 @@ class RegValueTypes(enum.Enum):
         except ValueError:
             return cls(RegValueTypes.REG_UNKNOWN)
 
+
 class RegKeyFlags(enum.IntEnum):
     KEY_IS_VOLATILE = 0x01
     KEY_HIVE_EXIT = 0x02
@@ -51,7 +52,8 @@ class RegKeyFlags(enum.IntEnum):
     KEY_PREFEF_HANDLE = 0x40
     KEY_VIRT_MIRRORED = 0x80
     KEY_VIRT_TARGET = 0x100
-    KEY_VIRTUAL_STORE= 0x200
+    KEY_VIRTUAL_STORE = 0x200
+
 
 class _HMAP_ENTRY(objects.Struct):
     def get_block_offset(self) -> int:
@@ -78,6 +80,40 @@ class _CMHIVE(objects.Struct):
     name = property(get_name)
 
 
+class _CM_KEY_BODY(objects.Struct):
+    """This represents an open handle to a registry key and
+    is not tied to the registry hive file format on disk."""
+
+    def _skip_key_hive_entry_path(self, kcb_flags):
+        """Win10 14393 introduced an extra path element that it skips
+        over by checking for Flags that contain KEY_HIVE_ENTRY"""
+
+        # _CM_KEY_BODY.Trans introduced in Win10 14393
+        if hasattr(self, "Trans") and RegKeyFlags.KEY_HIVE_ENTRY & kcb_flags == RegKeyFlags.KEY_HIVE_ENTRY:
+            return True
+
+        return False
+
+    def get_full_key_name(self) -> str:
+        output = []
+        kcb = self.KeyControlBlock
+        while kcb.ParentKcb:
+            if kcb.NameBlock.Name == None:
+                break
+
+            if self._skip_key_hive_entry_path(kcb.Flags):
+                kcb = kcb.ParentKcb
+                if not kcb:
+                    break
+
+            output.append(kcb.NameBlock.Name.cast("string",
+                                                  encoding = "utf8",
+                                                  max_length = kcb.NameBlock.NameLength,
+                                                  errors = "replace"))
+            kcb = kcb.ParentKcb
+        return "\\".join(reversed(output))
+
+
 class _CM_KEY_NODE(objects.Struct):
     """Extension to allow traversal of registry keys"""