From a906506736d6410776ebaf3d6f3760e3c86a1e1d Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Feb 2025 13:25:40 -0600 Subject: [PATCH] #1639 - cast big data to _CM_BIG_DATA --- volatility3/framework/symbols/windows/extensions/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index a8cc7703c..6d660a4b9 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -329,7 +329,7 @@ class CM_KEY_VALUE(objects.StructType): data = layer.read(self.Data.vol.offset, datalen) elif layer.hive.Version == 5 and datalen > 0x4000: # We're bigdata - big_data = layer.get_node(self.Data) + big_data = layer.get_node(self.Data).cast("_CM_BIG_DATA") # Oddly, we get a list of addresses, at which are addresses, which then point to data blocks for i in range(big_data.Count): # The value 4 should actually be unsigned-int.size, but since it's a file format that shouldn't change