From d6a1e9acfc3ce306bda0f8260b0e4134dde01bcf Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 22 Aug 2018 10:43:32 -0500 Subject: [PATCH] add an optional filter to hivelist to return only matching names --- volatility/plugins/windows/hivelist.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index dde3d7c59..cdb0a5ebc 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -12,7 +12,11 @@ class HiveList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")] + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + requirements.StringRequirement(name = 'filter', + description = "String to filter hive names returned", + optional = True, + default = None)] def _generator(self): for hive in self.list_hives(): @@ -35,7 +39,8 @@ class HiveList(plugins.PluginInterface): cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff) for hive in cmhive.HiveList: - yield hive + if self.config.get("filter", None) is None or self.config["filter"].lower() in str(hive.get_name() or "").lower(): + yield hive def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex),