Merge pull request #1501 from volatilityfoundation/issue_1484_printkey_traceback

Windows Registry: Catch RegistryInvalidIndex
2026-09-08 10:47:38 +02:00 · 2025-01-01 12:59:49 +00:00
parent 6d0d9c4ec0 fa67f10d31
commit 9a4ec65e19
1 changed files with 7 additions and 1 deletions
@@ -140,7 +140,13 @@ class RegistryHive(linear.LinearlyMappedLayer):
        """Returns the appropriate Node, interpreted from the Cell based on its
        Signature."""
        cell = self.get_cell(cell_offset)
-        signature = cell.cast("string", max_length=2, encoding="latin-1")
+        try:
+            signature = cell.cast("string", max_length=2, encoding="latin-1")
+        except (RegistryInvalidIndex, exceptions.InvalidAddressException):
+            vollog.debug(
+                f"Failed to get cell signature for cell (0x{cell.vol.offset:x})"
+            )
+            return cell
        if signature == "nk":
            return cell.u.KeyNode
        elif signature == "sk":