From a5fc7323ec6e887b9b5852edf3d83e64a49476be Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 May 2020 00:02:25 +0100 Subject: [PATCH] Registry: Don't make assumptions about the default --- volatility/framework/plugins/windows/registry/printkey.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index ceb7b36fc..052b8160c 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -133,7 +133,7 @@ class PrintKey(interfaces.plugins.PluginInterface): value_type = renderers.UnreadableValue() result = (depth, (last_write_time, renderers.format_hints.Hex(hive.hive_offset), value_type, key_path, - value_node_name, format_hints.StrLike(value_data), volatile)) + value_node_name, format_hints.StrLike(value_data, encoding = 'utf-16-le'), volatile)) yield result def _registry_walker(self,