Update userassist to use the new printkey API.

volatility/framework/plugins/windows/registry/printkey.py

@@ -4,7 +4,7 @@
 
 import datetime
 import logging
-from typing import Generator, List, Sequence, Iterable
+from typing import Generator, List, Sequence, Iterable, Optional
 
 from volatility.framework import objects, renderers, exceptions, interfaces, constants
 from volatility.framework.configuration import requirements
@@ -85,6 +85,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
                       base_config_path: str,
                       layer_name: str,
                       symbol_table: str,
+                      filter_string: Optional[str] = None,
                       hive_offsets: List[int] = None) -> Iterable[RegistryHive]:
         """Walks through a registry, hive by hive returning the constructed
         registry layer name.
@@ -93,7 +94,8 @@ class PrintKey(interfaces.plugins.PluginInterface):
             context: The context to retrieve required elements (layers, symbol tables) from
             layer_name: The name of the layer on which to operate
             symbol_table: The name of the table containing the kernel symbols
-            offset: An optional offset to specify a specific hive to iterator over
+            filter_string: An optional string which must be present in the hive name if specified 
+            offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string)
 
         Yields:
             A registry hive layer name
@@ -101,7 +103,8 @@ class PrintKey(interfaces.plugins.PluginInterface):
         if hive_offsets is None:
             try:
                 hive_offsets = [
-                    hive.vol.offset for hive in hivelist.HiveList.list_hives(context, layer_name, symbol_table)
+                    hive.vol.offset
+                    for hive in hivelist.HiveList.list_hives(context, layer_name, symbol_table, filter_string)
                 ]
             except ImportError:
                 vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset")

volatility/framework/plugins/windows/registry/userassist.py

@@ -9,6 +9,8 @@ import logging
 import os
 from typing import Any, List, Tuple, Generator
 
+import volatility.plugins.windows.registry.printkey as printkey
+
 from volatility.framework import exceptions, renderers, constants, interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.physical import BufferDataLayer
@@ -208,50 +210,25 @@ class UserAssist(interfaces.plugins.PluginInterface):
     def _generator(self):
 
         # get all the user hive offsets or use the one specified
-        if self.config.get('offset', None) is None:
-            try:
-                import volatility.plugins.windows.registry.hivelist as hivelist
-                hive_offsets = [
-                    hive.vol.offset for hive in hivelist.HiveList.list_hives(
-                        context = self.context,
-                        layer_name = self.config['primary'],
-                        symbol_table = self.config['nt_symbols'],
-                        filter_string = "ntuser.dat")
-                ]
-            except ImportError:
-                vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset")
-                raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset")
-        else:
-            hive_offsets = [self.config['offset']]
-
-        self._reg_table_name = intermed.IntermediateSymbolTable.create(self.context, self._config_path, 'windows',
-                                                                       'registry')
-
-        for hive_offset in hive_offsets:
-            # Construct the hive
-            reg_config_path = self.make_subconfig(
+        for hive in printkey.PrintKey.hive_iterator(
                 context = self.context,
                 base_config_path = self.config_path,
-                base_layer = self.config['primary'],
-                nt_symbols = self.config['nt_symbols'],
-                hive_offset = hive_offset)
-
-            hive_name = None
+                layer_name = self.config['primary'],
+                symbol_table = self.config['nt_symbols'],
+                filter_string = 'ntuser.data',
+                offsets = [self.config.get('offset', None)]):
             try:
-                hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
-                hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name()
-                self.context.layers.add_layer(hive)
                 yield from self.list_userassist(hive)
                 continue
             except exceptions.PagedInvalidAddressException as excp:
                 vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address)))
             except KeyError:
                 vollog.debug("Key '{}' not found in Hive at offset {}.".format(
-                    "software\\microsoft\\windows\\currentversion\\explorer\\userassist", hex(hive_offset)))
+                    "software\\microsoft\\windows\\currentversion\\explorer\\userassist", hex(hive.hive_offset)))
 
             # yield UnreadableValues when an exception occurs for a given hive_offset
-            result = (0, (renderers.format_hints.Hex(hive_offset),
-                          hive_name if hive_name else renderers.UnreadableValue(), renderers.UnreadableValue(),
+            result = (0, (renderers.format_hints.Hex(hive.hive_offset),
+                          hive.name if hive.name else renderers.UnreadableValue(), renderers.UnreadableValue(),
                           renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(),
                           renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(),
                           renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue()))