From d4ea03f51d27ea9e5d3448a85900eaf867e688a6 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Fri, 9 Mar 2018 01:00:48 +0000
Subject: [PATCH] Add in hive offsets to printkey output.

---
 volatility/framework/layers/registry.py | 4 ++++
 volatility/plugins/windows/printkey.py  | 8 +++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index 2f12fda6a..5a563dad7 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -55,6 +55,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
             raise exceptions.StructureException(
                 "Invalid registry base_block length: {}".format(self._base_block.Length))
 
+    @property
+    def hive_offset(self) -> int:
+        return self._hive_offset
+
     @property
     def address_mask(self) -> int:
         """Return a mask that allows for the volatile bit to be set"""
diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py
index 724ee82e0..ad298a0a1 100644
--- a/volatility/plugins/windows/printkey.py
+++ b/volatility/plugins/windows/printkey.py
@@ -1,7 +1,9 @@
 import datetime
 import logging
+import typing
 
 import volatility.framework.interfaces.plugins as plugins
+from volatility.framework import renderers
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
 from volatility.framework.renderers import TreeGrid
@@ -36,7 +38,8 @@ class PrintKey(plugins.PluginInterface):
     def update_configuration(self):
         """No operation since all values provided by config/requirements initially"""
 
-    def hive_walker(self, hive, node = None, key_path = None):
+    def hive_walker(self, hive: RegistryHive, node: int = None, key_path: str = None) \
+            -> typing.Generator:
         if not node:
             node = hive.get_node(hive.root_cell_offset)
         if key_path is None:
@@ -47,6 +50,7 @@ class PrintKey(plugins.PluginInterface):
         for key_node in node.get_subkeys():
             result = (key_path.count("\\"),
                       (str(datetime.datetime.utcfromtimestamp(unix_time)),
+                       renderers.format_hints.Hex(hive.hive_offset),
                        "Key",
                        key_path,
                        key_node.get_name(),
@@ -57,6 +61,7 @@ class PrintKey(plugins.PluginInterface):
         for value_node in node.get_values():
             result = (key_path.count("\\"),
                       (str(datetime.datetime.utcfromtimestamp(unix_time)),
+                       renderers.format_hints.Hex(hive.hive_offset),
                        RegValueTypes(value_node.Type).name,
                        key_path,
                        value_node.get_name(),
@@ -103,6 +108,7 @@ class PrintKey(plugins.PluginInterface):
     def run(self):
 
         return TreeGrid(columns = [('Last Write Time', str),
+                                   ('Hive Offset', renderers.format_hints.Hex),
                                    ('Type', str),
                                    ('Key', str),
                                    ('Name', str),