From adeb2e6a270ef66d7b4cb2d6208c5fa7c11d7548 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 13 Sep 2019 11:56:40 +0100 Subject: [PATCH] Revert "Provide a more user friendly filename." As Dave pointed out in the pull request, "User" assumes only one user and not multiple hives. This reverts commit a802ecab86aca06b56c3fca2ed140129f8d85c79. --- volatility/plugins/windows/registry/certificates.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility/plugins/windows/registry/certificates.py index 413670976..553166583 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility/plugins/windows/registry/certificates.py @@ -39,8 +39,9 @@ class Certificates(interfaces.plugins.PluginInterface): layer_name = self.config['primary'], symbol_table = self.config['nt_symbols']): - for key_type, top_key in [("Machine", "Microsoft\\SystemCertificates"), - ("User", "Software\\Microsoft\\SystemCertificates")]: + for top_key in ["Microsoft\\SystemCertificates", + "Software\\Microsoft\\SystemCertificates", + ]: try: # Walk it node_path = hive.get_key(top_key, return_list = True) @@ -53,8 +54,8 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - filedata = interfaces.plugins.FileInterface("{} - {} - {}.crt".format( - key_type, reg_section, key_hash)) + filedata = interfaces.plugins.FileInterface( + "{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, key_hash)) filedata.data.write(certificate_data) self.produce_file(filedata) yield (0, (top_key, reg_section, key_hash, name))