WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

check if hive offset is valid before yielding

Browse Source
This commit is contained in:
superponible
2019-09-17 16:59:50 +01:00
committed by ikelos
parent 442b47c87d
commit ae8822dddf
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/registry/hivelist.py
+5 -3
View File
@@ -117,8 +117,9 @@ class HiveList(plugins.PluginInterface):
try:
for hive in cmhive.HiveList:
if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower():
seen.add(hive.vol.offset)
yield hive
if context.layers[layer_name].is_valid(hive.vol.offset):
seen.add(hive.vol.offset)
yield hive
except exceptions.InvalidAddressException:
vollog.warning("Hivelist failed traversing the list forwards, traversing backwards")
traverse_backwards = True
@@ -128,7 +129,8 @@ class HiveList(plugins.PluginInterface):
for hive in cmhive.HiveList.to_list(cmhive.vol.type_name, "HiveList", forward = False):
if filter_string is None or filter_string.lower() in str(
hive.get_name() or "").lower() and hive.vol.offset not in seen:
yield hive
if context.layers[layer_name].is_valid(hive.vol.offset):
yield hive
except exceptions.InvalidAddressException:
vollog.warning("Hivelist failed traversing the list backwards, giving up")