#1473 - add missing exception handling for get_key

volatility3/framework/plugins/windows/envars.py

@@ -76,14 +76,14 @@ class Envars(interfaces.plugins.PluginInterface):
                     "CurrentControlSet\\Control\\Session Manager\\Environment"
                 )
                 sys = True
-            except KeyError:
-                with contextlib.suppress(KeyError):
+            except (KeyError, registry.RegistryFormatException):
+                with contextlib.suppress(KeyError, registry.RegistryFormatException):
                     key = hive.get_key(
                         "ControlSet001\\Control\\Session Manager\\Environment"
                     )
                     sys = True
             if sys:
-                with contextlib.suppress(KeyError):
+                with contextlib.suppress(KeyError, registry.RegistryFormatException):
                     for node in key.get_values():
                         try:
                             value_node_name = node.get_name()
@@ -100,11 +100,11 @@ class Envars(interfaces.plugins.PluginInterface):
                             continue
 
             ## The user-specific variables
-            with contextlib.suppress(KeyError):
+            with contextlib.suppress(KeyError, registry.RegistryFormatException):
                 key = hive.get_key("Environment")
                 ntuser = True
             if ntuser:
-                with contextlib.suppress(KeyError):
+                with contextlib.suppress(KeyError, registry.RegistryFormatException):
                     for node in key.get_values():
                         try:
                             value_node_name = node.get_name()
@@ -123,7 +123,7 @@ class Envars(interfaces.plugins.PluginInterface):
             ## The volatile user variables
             try:
                 key = hive.get_key("Volatile Environment")
-            except KeyError:
+            except (KeyError, registry.RegistryFormatException):
                 continue
             try:
                 for node in key.get_values():

volatility3/framework/plugins/windows/getservicesids.py

@@ -10,6 +10,7 @@ from typing import List
 
 from volatility3.framework import renderers, interfaces, constants, exceptions
 from volatility3.framework.configuration import requirements
+from volatility3.framework.layers import registry
 from volatility3.plugins.windows.registry import hivelist
 
 vollog = logging.getLogger(__name__)
@@ -86,10 +87,10 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
             # Get ControlSet\Services.
             try:
                 services = hive.get_key(r"CurrentControlSet\Services")
-            except (KeyError, exceptions.InvalidAddressException):
+            except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException):
                 try:
                     services = hive.get_key(r"ControlSet001\Services")
-                except (KeyError, exceptions.InvalidAddressException):
+                except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException):
                     continue
 
             if services:

volatility3/framework/plugins/windows/getsids.py

@@ -158,7 +158,7 @@ class GetSIDs(interfaces.plugins.PluginInterface):
                             layers.registry.RegistryFormatException,
                         ):
                             continue
-            except (KeyError, exceptions.InvalidAddressException):
+            except (KeyError, exceptions.InvalidAddressException, layers.registry.RegistryFormatException):
                 continue
 
         return sids

volatility3/framework/plugins/windows/registry/userassist.py

@@ -13,7 +13,7 @@ from typing import Any, Generator, List, Tuple
 from volatility3.framework import constants, exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers.physical import BufferDataLayer
-from volatility3.framework.layers.registry import RegistryHive
+from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException
 from volatility3.framework.renderers import conversion, format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.plugins.windows.registry import hivelist
@@ -167,10 +167,17 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac
 
         self._determine_userassist_type()
 
-        userassist_node_path = hive.get_key(
-            "software\\microsoft\\windows\\currentversion\\explorer\\userassist",
-            return_list=True,
-        )
+        try:
+            userassist_node_path = hive.get_key(
+                "software\\microsoft\\windows\\currentversion\\explorer\\userassist",
+                return_list=True,
+            )
+        except RegistryFormatException as e:
+            vollog.warning(f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}")
+            return None
+        except KeyError:
+            vollog.warning(f"UserAssist key not found in {hive_name} at {hive.hive_offset:#x}")
+            return None
 
         if not userassist_node_path:
             vollog.warning("list_userassist did not find a valid node_path (or None)")

volatility3/framework/plugins/windows/svcscan.py

@@ -15,7 +15,7 @@ from volatility3.framework import (
     symbols,
 )
 from volatility3.framework.configuration import requirements
-from volatility3.framework.layers import scanners
+from volatility3.framework.layers import scanners, registry
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows import versions
@@ -159,12 +159,12 @@ class SvcScan(interfaces.plugins.PluginInterface):
                 return cast(
                     objects.StructType, hive.get_key(r"CurrentControlSet\Services")
                 )
-            except (KeyError, exceptions.InvalidAddressException):
+            except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException):
                 try:
                     return cast(
                         objects.StructType, hive.get_key(r"ControlSet001\Services")
                     )
-                except (KeyError, exceptions.InvalidAddressException):
+                except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException):
                     vollog.log(
                         constants.LOGLEVEL_VVVV,
                         "Could not retrieve any control set from SYSTEM hive",