From cb3e18ec9e354843cd4cff2f0fe6ba9befda6efd Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 19 May 2025 13:24:58 +0300 Subject: [PATCH] Update hashdump.py calling `.Name` returns array, changed to `.get_name()` which returns a string (the if statement in the code didn't work before this change) --- volatility3/framework/plugins/windows/registry/hashdump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 1883d4530..256f15d61 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -350,7 +350,7 @@ class Hashdump(interfaces.plugins.PluginInterface): if not user_key: return [] - return [k for k in user_key.get_subkeys() if k.Name != "Names"] + return [k for k in user_key.get_subkeys() if k.get_name() != "Names"] @classmethod def get_bootkey(cls, syshive: registry_layer.RegistryHive) -> Optional[bytes]: