diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index 132e7ba66..4932490fe 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -201,12 +201,14 @@ class CM_KEY_NODE(objects.StructType): if node.vol.type_name.endswith(constants.BANG + '_CM_KEY_VALUE'): yield node except (exceptions.InvalidAddressException, RegistryFormatException) as excp: - vollog.debug("Invalid address {}".format(excp)) + vollog.debug("Invalid address in get_values iteration: {}".format(excp)) return def get_name(self) -> interfaces.objects.ObjectInterface: - """Since this is just a casting convenience, it can be a property.""" - return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1") + """Gets the name for the current key node""" + namelength = self.NameLength + self.Name.count = namelength + return self.Name.cast("string", max_length = namelength, encoding = "latin-1") def get_key_path(self) -> str: reg = self._context.layers[self.vol.layer_name] @@ -224,24 +226,29 @@ class CM_KEY_VALUE(objects.StructType): """Extensions to extract data from CM_KEY_VALUE nodes.""" def get_name(self) -> interfaces.objects.ObjectInterface: - """Since this is just a casting convenience, it can be a property.""" - self.Name.count = self.NameLength - return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1") + """Gets the name for the current key value""" + namelength = self.NameLength + self.Name.count = namelength + return self.Name.cast("string", max_length = namelength, encoding = "latin-1") def decode_data(self) -> Union[str, bytes]: - """Since this is just a casting convenience, it can be a property.""" + """Properly decodes the data associated with the value node""" # Determine if the data is stored inline - datalen = self.DataLength & 0x7fffffff + datalen = self.DataLength data = b"" # Check if the data is stored inline layer = self._context.layers[self.vol.layer_name] if not isinstance(layer, RegistryHive): raise TypeError("Key value was not instantiated on a RegistryHive layer") - if self.DataLength & 0x80000000 and (0 > datalen or datalen > 4): - raise ValueError("Unable to read inline registry value with excessive length: {}".format(datalen)) - elif self.DataLength & 0x80000000: - data = layer.read(self.Data.vol.offset, datalen) + # If the high-bit is set + if datalen & 0x80000000: + # Remove the high bit + datalen = datalen & 0x7fffffff + if (0 > datalen or datalen > 4): + raise ValueError("Unable to read inline registry value with excessive length: {}".format(datalen)) + else: + data = layer.read(self.Data.vol.offset, datalen) elif layer.hive.Version == 5 and datalen > 0x4000: # We're bigdata big_data = layer.get_node(self.Data)