From 918452f06742a3b24dfef9d4e65e7e5d88e0161d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 8 Nov 2017 11:40:45 +0000 Subject: [PATCH] Remove deprecated volatile property in favour of the helper-prefixed property namespace. --- volatility/framework/symbols/windows/extensions/registry.py | 2 +- volatility/plugins/windows/printkey.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index ee086a124..f0e558e7d 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -54,7 +54,7 @@ class _CM_KEY_NODE(objects.Struct): """Extension to allow traversal of registry keys""" @property - def volatile(self): + def helper_volatile(self): if not isinstance(self._context.memory[self.vol.layer_name], RegistryHive): raise ValueError("Cannot determine volatility of registry key without an offset in a RegistryHive layer") return bool(self.vol.offset & 0x80000000) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index b6f355285..3ac7e4237 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -48,7 +48,7 @@ class PrintKey(plugins.PluginInterface): "Key", key_node.helper_name, "", - key_node.volatile)) + key_node.helper_volatile)) yield result for value_node in node.get_values(): @@ -58,7 +58,7 @@ class PrintKey(plugins.PluginInterface): RegValueTypes(value_node.Type).name, value_node.helper_name, str(value_node.decode_data()), - node.volatile)) + node.helper_volatile)) yield result if self.config['recurse']: