diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 32acbc4a9..6f0d66beb 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,13 +66,13 @@ class RegistryHive(linear.LinearlyMappedLayer): self._hive_maxaddr_non_volatile = self.hive.Storage[0].Length self._hive_maxaddr_volatile = self.hive.Storage[1].Length self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile - vollog.log(constants.LOGLEVEL_VVV, "Setting hive max address to {}".format(hex(self._maxaddr))) + vollog.log(constants.LOGLEVEL_VVVV, f"Setting hive {self.name} max address to {hex(self._maxaddr)}") except exceptions.InvalidAddressException: self._hive_maxaddr_non_volatile = 0x7fffffff self._hive_maxaddr_volatile = 0x7fffffff self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile - vollog.log(constants.LOGLEVEL_VVV, - "Exception when setting hive max address, using {}".format(hex(self._maxaddr))) + vollog.log(constants.LOGLEVEL_VVVV, + f"Exception when setting hive {self.name} max address, using {hex(self._maxaddr)}") def _get_hive_maxaddr(self, volatile): return self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile @@ -199,6 +199,13 @@ class RegistryHive(linear.LinearlyMappedLayer): # Ignore the volatile bit when determining maxaddr validity volatile = self._mask(offset, 31, 31) >> 31 if offset & 0x7fffffff > self._get_hive_maxaddr(volatile): + vollog.log(constants.LOGLEVEL_VVV, + "Layer {} couldn't translate offset {}, greater than {} in {} store of {}".format( + self.name, + hex(offset & 0x7fffffff), + hex(self._get_hive_maxaddr(volatile)), + "volative" if volatile else "non-volatile", + self.get_name())) raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr") storage = self.hive.Storage[volatile] diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 2b5ab11f4..f8a78dfcd 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -62,13 +62,14 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): def _generator(self): - # Go all over the hives + # Get the system hive for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], + filter_string = 'machine\\system', hive_offsets = None): - # Get ConrolSet\Services. + # Get ControlSet\Services. try: services = hive.get_key(r"CurrentControlSet\Services") except (KeyError, exceptions.InvalidAddressException): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 30503b2bf..89b1f5f4f 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -81,6 +81,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], + filter_string = 'config\\software', hive_offsets = None): try: