From ae8822dddf6a511026fce409bfb31c55bca81ac1 Mon Sep 17 00:00:00 2001 From: superponible Date: Fri, 13 Sep 2019 10:59:55 -0500 Subject: [PATCH] check if hive offset is valid before yielding --- volatility/framework/plugins/windows/registry/hivelist.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index ccb89e739..d46b846d9 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -117,8 +117,9 @@ class HiveList(plugins.PluginInterface): try: for hive in cmhive.HiveList: if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower(): - seen.add(hive.vol.offset) - yield hive + if context.layers[layer_name].is_valid(hive.vol.offset): + seen.add(hive.vol.offset) + yield hive except exceptions.InvalidAddressException: vollog.warning("Hivelist failed traversing the list forwards, traversing backwards") traverse_backwards = True @@ -128,7 +129,8 @@ class HiveList(plugins.PluginInterface): for hive in cmhive.HiveList.to_list(cmhive.vol.type_name, "HiveList", forward = False): if filter_string is None or filter_string.lower() in str( hive.get_name() or "").lower() and hive.vol.offset not in seen: - yield hive + if context.layers[layer_name].is_valid(hive.vol.offset): + yield hive except exceptions.InvalidAddressException: vollog.warning("Hivelist failed traversing the list backwards, giving up")