WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #561 from volatilityfoundation/issues/issue_547_regvaluetype_usage

Browse Source 
Correct usage for RegValueTypes enum
This commit is contained in:
ikelos
2021-09-05 12:50:45 +01:00
committed by GitHub
parent 17efe7dbdc 6492a458db
commit df5df3dbe4
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/getsids.py
+2 -2
View File
@@ -96,9 +96,9 @@ class GetSIDs(interfaces.plugins.PluginInterface):
value_data = node.decode_data()
if isinstance(value_data, int):
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8')
elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_BINARY:
elif registry.RegValueTypes(node.Type) == registry.RegValueTypes.REG_BINARY:
value_data = format_hints.MultiTypeData(value_data, show_hex = True)
elif registry.RegValueTypes[node.Type] == registry.RegValueTypes.REG_MULTI_SZ:
elif registry.RegValueTypes(node.Type) == registry.RegValueTypes.REG_MULTI_SZ:
value_data = format_hints.MultiTypeData(value_data,
encoding = 'utf-16-le',
split_nulls = True)
volatility3/framework/plugins/windows/registry/printkey.py
+3 -3
View File
@@ -121,7 +121,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
value_node_name = renderers.UnreadableValue()
try:
value_type = RegValueTypes[node.Type].name
value_type = RegValueTypes(node.Type).name
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.debug(excp)
value_type = renderers.UnreadableValue()
@@ -135,9 +135,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
if isinstance(value_data, int):
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8')
elif RegValueTypes[node.Type] == RegValueTypes.REG_BINARY:
elif RegValueTypes(node.Type) == RegValueTypes.REG_BINARY:
value_data = format_hints.MultiTypeData(value_data, show_hex = True)
elif RegValueTypes[node.Type] == RegValueTypes.REG_MULTI_SZ:
elif RegValueTypes(node.Type) == RegValueTypes.REG_MULTI_SZ:
value_data = format_hints.MultiTypeData(value_data,
encoding = 'utf-16-le',
split_nulls = True)
volatility3/plugins/windows/registry/certificates.py
+1 -1
View File
@@ -50,7 +50,7 @@ class Certificates(interfaces.plugins.PluginInterface):
node_path = hive.get_key(top_key, return_list = True)
for (depth, is_key, last_write_time, key_path, volatility,
node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True):
if not is_key and RegValueTypes[node.Type].name == "REG_BINARY":
if not is_key and RegValueTypes(node.Type).name == "REG_BINARY":
name, certificate_data = self.parse_data(node.decode_data())
unique_key_offset = key_path.index(top_key) + len(top_key) + 1
reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]