diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 923c3f0f6..5061f380b 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -4,7 +4,7 @@ import datetime import logging -from typing import Generator, List, Sequence, Iterable +from typing import Generator, List, Sequence, Iterable, Optional from volatility.framework import objects, renderers, exceptions, interfaces, constants from volatility.framework.configuration import requirements @@ -85,6 +85,7 @@ class PrintKey(interfaces.plugins.PluginInterface): base_config_path: str, layer_name: str, symbol_table: str, + filter_string: Optional[str] = None, hive_offsets: List[int] = None) -> Iterable[RegistryHive]: """Walks through a registry, hive by hive returning the constructed registry layer name. @@ -93,7 +94,8 @@ class PrintKey(interfaces.plugins.PluginInterface): context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols - offset: An optional offset to specify a specific hive to iterator over + filter_string: An optional string which must be present in the hive name if specified + offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string) Yields: A registry hive layer name @@ -101,7 +103,8 @@ class PrintKey(interfaces.plugins.PluginInterface): if hive_offsets is None: try: hive_offsets = [ - hive.vol.offset for hive in hivelist.HiveList.list_hives(context, layer_name, symbol_table) + hive.vol.offset + for hive in hivelist.HiveList.list_hives(context, layer_name, symbol_table, filter_string) ] except ImportError: vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index cc7e23fd4..38cb617c3 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -9,6 +9,8 @@ import logging import os from typing import Any, List, Tuple, Generator +import volatility.plugins.windows.registry.printkey as printkey + from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.layers.physical import BufferDataLayer @@ -208,50 +210,25 @@ class UserAssist(interfaces.plugins.PluginInterface): def _generator(self): # get all the user hive offsets or use the one specified - if self.config.get('offset', None) is None: - try: - import volatility.plugins.windows.registry.hivelist as hivelist - hive_offsets = [ - hive.vol.offset for hive in hivelist.HiveList.list_hives( - context = self.context, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols'], - filter_string = "ntuser.dat") - ] - except ImportError: - vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") - raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset") - else: - hive_offsets = [self.config['offset']] - - self._reg_table_name = intermed.IntermediateSymbolTable.create(self.context, self._config_path, 'windows', - 'registry') - - for hive_offset in hive_offsets: - # Construct the hive - reg_config_path = self.make_subconfig( + for hive in printkey.PrintKey.hive_iterator( context = self.context, base_config_path = self.config_path, - base_layer = self.config['primary'], - nt_symbols = self.config['nt_symbols'], - hive_offset = hive_offset) - - hive_name = None + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_string = 'ntuser.data', + offsets = [self.config.get('offset', None)]): try: - hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset)) - hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name() - self.context.layers.add_layer(hive) yield from self.list_userassist(hive) continue except exceptions.PagedInvalidAddressException as excp: vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address))) except KeyError: vollog.debug("Key '{}' not found in Hive at offset {}.".format( - "software\\microsoft\\windows\\currentversion\\explorer\\userassist", hex(hive_offset))) + "software\\microsoft\\windows\\currentversion\\explorer\\userassist", hex(hive.hive_offset))) # yield UnreadableValues when an exception occurs for a given hive_offset - result = (0, (renderers.format_hints.Hex(hive_offset), - hive_name if hive_name else renderers.UnreadableValue(), renderers.UnreadableValue(), + result = (0, (renderers.format_hints.Hex(hive.hive_offset), + hive.name if hive.name else renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue()))