From cd78958161afb1941dd47172fabfe1b623c45f91 Mon Sep 17 00:00:00 2001 From: Jack Wenger Date: Fri, 7 Aug 2020 14:31:47 -0400 Subject: [PATCH] Fixed requested issues --- volatility/framework/plugins/windows/hashdump.py | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility/framework/plugins/windows/hashdump.py index f95c7ed94..496aa29bb 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility/framework/plugins/windows/hashdump.py @@ -18,8 +18,6 @@ from volatility.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) -vollog = logging.getLogger(__name__) - class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" @@ -75,12 +73,9 @@ class Hashdump(interfaces.plugins.PluginInterface): lsa_base = "ControlSet{0:03}".format(cs) + "\\Control\\Lsa" lsa_keys = ["JD", "Skew1", "GBG", "Data"] - - try: - lsa = syshive.get_key(lsa_base) - - except KeyError: - vollog.debug("Unable to read hashes from registry") + lsa = syshive.get_key(lsa_base) + + if not lsa: return None bootkey = ''