diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 0314bb8f4..75c9298b4 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -1,7 +1,4 @@ -import typing - from volatility.framework import interfaces -from volatility.framework.configuration import requirements from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions from volatility.framework.symbols.windows.extensions import registry @@ -25,7 +22,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('_OBJECT_HEADER', extensions._OBJECT_HEADER) self.set_type_class('_FILE_OBJECT', extensions._FILE_OBJECT) self.set_type_class('_DEVICE_OBJECT', extensions._DEVICE_OBJECT) - self.set_type_class('_CM_KEY_BODY', extensions._CM_KEY_BODY) + self.set_type_class('_CM_KEY_BODY', registry._CM_KEY_BODY) self.set_type_class('_CMHIVE', registry._CMHIVE) self.set_type_class('_CM_KEY_NODE', registry._CM_KEY_NODE) self.set_type_class('_CM_KEY_VALUE', registry._CM_KEY_VALUE) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 48b73b0be..a6128f313 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -8,7 +8,6 @@ from volatility.framework import constants, exceptions, interfaces, objects, ren from volatility.framework.layers import intel from volatility.framework.renderers import conversion from volatility.framework.symbols import generic -from volatility.framework.symbols.windows.extensions.registry import RegKeyFlags vollog = logging.getLogger(__name__) @@ -405,40 +404,6 @@ class ExecutiveObject(interfaces.objects.ObjectInterface): native_layer_name = self.vol.native_layer_name) -class _CM_KEY_BODY(objects.Struct): - """This represents an open handle to a registry key and - is not tied to the registry hive file format on disk.""" - - def _skip_key_hive_entry_path(self, kcb_flags): - """Win10 14393 introduced an extra path element that it skips - over by checking for Flags that contain KEY_HIVE_ENTRY""" - - # _CM_KEY_BODY.Trans introduced in Win10 14393 - if hasattr(self, "Trans") and RegKeyFlags.KEY_HIVE_ENTRY & kcb_flags == RegKeyFlags.KEY_HIVE_ENTRY: - return True - - return False - - def get_full_key_name(self) -> str: - output = [] - kcb = self.KeyControlBlock - while kcb.ParentKcb: - if kcb.NameBlock.Name == None: - break - - if self._skip_key_hive_entry_path(kcb.Flags): - kcb = kcb.ParentKcb - if not kcb: - break - - output.append(kcb.NameBlock.Name.cast("string", - encoding = "utf8", - max_length = kcb.NameBlock.NameLength, - errors = "replace")) - kcb = kcb.ParentKcb - return "\\".join(reversed(output)) - - class _DEVICE_OBJECT(objects.Struct, ExecutiveObject): """A class for kernel device objects.""" diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index c0cea7c47..9ee7cd28e 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -41,6 +41,7 @@ class RegValueTypes(enum.Enum): except ValueError: return cls(RegValueTypes.REG_UNKNOWN) + class RegKeyFlags(enum.IntEnum): KEY_IS_VOLATILE = 0x01 KEY_HIVE_EXIT = 0x02 @@ -51,7 +52,8 @@ class RegKeyFlags(enum.IntEnum): KEY_PREFEF_HANDLE = 0x40 KEY_VIRT_MIRRORED = 0x80 KEY_VIRT_TARGET = 0x100 - KEY_VIRTUAL_STORE= 0x200 + KEY_VIRTUAL_STORE = 0x200 + class _HMAP_ENTRY(objects.Struct): def get_block_offset(self) -> int: @@ -78,6 +80,40 @@ class _CMHIVE(objects.Struct): name = property(get_name) +class _CM_KEY_BODY(objects.Struct): + """This represents an open handle to a registry key and + is not tied to the registry hive file format on disk.""" + + def _skip_key_hive_entry_path(self, kcb_flags): + """Win10 14393 introduced an extra path element that it skips + over by checking for Flags that contain KEY_HIVE_ENTRY""" + + # _CM_KEY_BODY.Trans introduced in Win10 14393 + if hasattr(self, "Trans") and RegKeyFlags.KEY_HIVE_ENTRY & kcb_flags == RegKeyFlags.KEY_HIVE_ENTRY: + return True + + return False + + def get_full_key_name(self) -> str: + output = [] + kcb = self.KeyControlBlock + while kcb.ParentKcb: + if kcb.NameBlock.Name == None: + break + + if self._skip_key_hive_entry_path(kcb.Flags): + kcb = kcb.ParentKcb + if not kcb: + break + + output.append(kcb.NameBlock.Name.cast("string", + encoding = "utf8", + max_length = kcb.NameBlock.NameLength, + errors = "replace")) + kcb = kcb.ParentKcb + return "\\".join(reversed(output)) + + class _CM_KEY_NODE(objects.Struct): """Extension to allow traversal of registry keys"""