WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-26 08:02:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Registry: Optimize calls to DataLength and improve documentation.

Browse Source
This commit is contained in:
Mike Auty
2020-01-15 22:59:58 +00:00
parent cedca0bb84
commit a3def09a13
1 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/registry.py
+19 -12
View File
@@ -201,12 +201,14 @@ class CM_KEY_NODE(objects.StructType):
if node.vol.type_name.endswith(constants.BANG + '_CM_KEY_VALUE'):
yield node
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.debug("Invalid address {}".format(excp))
vollog.debug("Invalid address in get_values iteration: {}".format(excp))
return
def get_name(self) -> interfaces.objects.ObjectInterface:
"""Since this is just a casting convenience, it can be a property."""
return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1")
"""Gets the name for the current key node"""
namelength = self.NameLength
self.Name.count = namelength
return self.Name.cast("string", max_length = namelength, encoding = "latin-1")
def get_key_path(self) -> str:
reg = self._context.layers[self.vol.layer_name]
@@ -224,24 +226,29 @@ class CM_KEY_VALUE(objects.StructType):
"""Extensions to extract data from CM_KEY_VALUE nodes."""
def get_name(self) -> interfaces.objects.ObjectInterface:
"""Since this is just a casting convenience, it can be a property."""
self.Name.count = self.NameLength
return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1")
"""Gets the name for the current key value"""
namelength = self.NameLength
self.Name.count = namelength
return self.Name.cast("string", max_length = namelength, encoding = "latin-1")
def decode_data(self) -> Union[str, bytes]:
"""Since this is just a casting convenience, it can be a property."""
"""Properly decodes the data associated with the value node"""
# Determine if the data is stored inline
datalen = self.DataLength & 0x7fffffff
datalen = self.DataLength
data = b""
# Check if the data is stored inline
layer = self._context.layers[self.vol.layer_name]
if not isinstance(layer, RegistryHive):
raise TypeError("Key value was not instantiated on a RegistryHive layer")
if self.DataLength & 0x80000000 and (0 > datalen or datalen > 4):
raise ValueError("Unable to read inline registry value with excessive length: {}".format(datalen))
elif self.DataLength & 0x80000000:
data = layer.read(self.Data.vol.offset, datalen)
# If the high-bit is set
if datalen & 0x80000000:
# Remove the high bit
datalen = datalen & 0x7fffffff
if (0 > datalen or datalen > 4):
raise ValueError("Unable to read inline registry value with excessive length: {}".format(datalen))
else:
data = layer.read(self.Data.vol.offset, datalen)
elif layer.hive.Version == 5 and datalen > 0x4000:
# We're bigdata
big_data = layer.get_node(self.Data)