Support the new HMAP_ENTRY structure for Win10.

volatility/framework/layers/registry.py

@@ -141,7 +141,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
 
         table = storage.Map.Directory[dir_index]
         entry = table.Table[table_index]
-        return entry.BlockAddress + suboffset
+        return entry.helper_block_offset + suboffset
 
     def mapping(self, offset, length, ignore_errors = False):
 

volatility/framework/symbols/windows/__init__.py

@@ -18,6 +18,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('_CMHIVE', registry._CMHIVE)
         self.set_type_class('_CM_KEY_NODE', registry._CM_KEY_NODE)
         self.set_type_class('_CM_KEY_VALUE', registry._CM_KEY_VALUE)
+        self.set_type_class('_HMAP_ENTRY', registry._HMAP_ENTRY)
 
     @classmethod
     def get_requirements(cls):

volatility/framework/symbols/windows/extensions/registry.py

@@ -23,6 +23,15 @@ class RegValueTypes(enum.Enum):
     REG_QWORD = 11
 
 
+class _HMAP_ENTRY(objects.Struct):
+    @property
+    def helper_block_offset(self):
+        try:
+            return self.PermanentBinAddress ^ (self.PermanentBinAddress & 0x3)
+        except AttributeError:
+            return self.BlockAddress
+
+
 class _CMHIVE(objects.Struct):
     @property
     def helper_name(self):