WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Provide a more user friendly filename.

Browse Source
This commit is contained in:
Mike Auty
2019-09-13 11:45:58 +01:00
parent eaea90dd43
commit a802ecab86
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/registry/certificates.py
+4 -5
View File
@@ -39,9 +39,8 @@ class Certificates(interfaces.plugins.PluginInterface):
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols']):
for top_key in ["Microsoft\\SystemCertificates",
"Software\\Microsoft\\SystemCertificates",
]:
for key_type, top_key in [("Machine", "Microsoft\\SystemCertificates"),
("User", "Software\\Microsoft\\SystemCertificates")]:
try:
# Walk it
node_path = hive.get_key(top_key, return_list = True)
@@ -54,8 +53,8 @@ class Certificates(interfaces.plugins.PluginInterface):
key_hash = key_path[key_path.rindex("\\") + 1:]
if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue):
filedata = interfaces.plugins.FileInterface(
"{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, key_hash))
filedata = interfaces.plugins.FileInterface("{} - {} - {}.crt".format(
key_type, reg_section, key_hash))
filedata.data.write(certificate_data)
self.produce_file(filedata)
yield (0, (top_key, reg_section, key_hash, name))