diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 9a3437bd6..8edfd877f 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -99,7 +99,11 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): return cell def get_key(self, key: str, return_list: bool = False) -> interfaces.objects.ObjectInterface: - """Gets a specific registry key by key path""" + """Gets a specific registry key by key path + + return_list specifies whether the return result will be a single node (default) or a list of nodes from + root to the current node (if return_list is true). + """ node_key = self.get_node(self.root_cell_offset) if not return_list else [self.get_node(self.root_cell_offset)] if key.endswith("\\"): key = key[:-1] diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index 50d70f921..9971a86e2 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -40,6 +40,9 @@ class PrintKey(plugins.PluginInterface): def hive_walker(self, hive: RegistryHive, node_path: typing.Sequence[objects.Struct] = None, key_path: str = None) \ -> typing.Generator: + """Walks through a set of nodes from a given node (last one in node_path). + Avoids loops by not traversing into nodes already present in the node_path + """ if not node_path: node_path = [hive.get_node(hive.root_cell_offset)] if not isinstance(node_path, list) or len(node_path) < 1: