From a802ecab86aca06b56c3fca2ed140129f8d85c79 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 13 Sep 2019 11:45:58 +0100 Subject: [PATCH] Provide a more user friendly filename. --- volatility/plugins/windows/registry/certificates.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility/plugins/windows/registry/certificates.py index 553166583..413670976 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility/plugins/windows/registry/certificates.py @@ -39,9 +39,8 @@ class Certificates(interfaces.plugins.PluginInterface): layer_name = self.config['primary'], symbol_table = self.config['nt_symbols']): - for top_key in ["Microsoft\\SystemCertificates", - "Software\\Microsoft\\SystemCertificates", - ]: + for key_type, top_key in [("Machine", "Microsoft\\SystemCertificates"), + ("User", "Software\\Microsoft\\SystemCertificates")]: try: # Walk it node_path = hive.get_key(top_key, return_list = True) @@ -54,8 +53,8 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - filedata = interfaces.plugins.FileInterface( - "{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, key_hash)) + filedata = interfaces.plugins.FileInterface("{} - {} - {}.crt".format( + key_type, reg_section, key_hash)) filedata.data.write(certificate_data) self.produce_file(filedata) yield (0, (top_key, reg_section, key_hash, name))