Merge pull request #1679 from Abyss-W4tcher/improve_lsadump_rendering

windows.lsadump: Improve secret readability
This commit is contained in:
ikelos
2025-03-08 13:17:51 +00:00
committed by GitHub
@@ -14,6 +14,7 @@ from volatility3.framework.layers import registry
from volatility3.framework.symbols.windows import versions
from volatility3.plugins.windows import hashdump
from volatility3.plugins.windows.registry import hivelist
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -209,7 +210,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
else:
secret = self.decrypt_aes(enc_secret, lsakey)
yield (0, (key.get_name(), secret.decode("latin1"), secret))
yield (0, (key.get_name(), format_hints.HexBytes(secret), secret))
def run(self):
offset = self.config.get("offset", None)
@@ -227,6 +228,6 @@ class Lsadump(interfaces.plugins.PluginInterface):
sechive = hive
return renderers.TreeGrid(
[("Key", str), ("Secret", str), ("Hex", bytes)],
[("Key", str), ("Secret", format_hints.HexBytes), ("Hex", bytes)],
self._generator(syshive, sechive),
)