From c09ce60f73bb41c15874fd692df63a208b6cc7a9 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 9 Oct 2017 01:40:37 +0100
Subject: [PATCH] Support the new HMAP_ENTRY structure for Win10.

---
 volatility/framework/layers/registry.py                  | 2 +-
 volatility/framework/symbols/windows/__init__.py         | 1 +
 .../framework/symbols/windows/extensions/registry.py     | 9 +++++++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index 161669b5c..a1ec02c1e 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -141,7 +141,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
 
         table = storage.Map.Directory[dir_index]
         entry = table.Table[table_index]
-        return entry.BlockAddress + suboffset
+        return entry.helper_block_offset + suboffset
 
     def mapping(self, offset, length, ignore_errors = False):
 
diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py
index 4ac186c32..2a2411e1c 100644
--- a/volatility/framework/symbols/windows/__init__.py
+++ b/volatility/framework/symbols/windows/__init__.py
@@ -18,6 +18,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('_CMHIVE', registry._CMHIVE)
         self.set_type_class('_CM_KEY_NODE', registry._CM_KEY_NODE)
         self.set_type_class('_CM_KEY_VALUE', registry._CM_KEY_VALUE)
+        self.set_type_class('_HMAP_ENTRY', registry._HMAP_ENTRY)
 
     @classmethod
     def get_requirements(cls):
diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py
index 45ef9452c..3b6e527c0 100644
--- a/volatility/framework/symbols/windows/extensions/registry.py
+++ b/volatility/framework/symbols/windows/extensions/registry.py
@@ -23,6 +23,15 @@ class RegValueTypes(enum.Enum):
     REG_QWORD = 11
 
 
+class _HMAP_ENTRY(objects.Struct):
+    @property
+    def helper_block_offset(self):
+        try:
+            return self.PermanentBinAddress ^ (self.PermanentBinAddress & 0x3)
+        except AttributeError:
+            return self.BlockAddress
+
+
 class _CMHIVE(objects.Struct):
     @property
     def helper_name(self):