From eaea90dd437cb9a253b67730cb0b0470c8aee7d4 Mon Sep 17 00:00:00 2001 From: superponible Date: Thu, 12 Sep 2019 22:17:02 -0500 Subject: [PATCH] add hive_offset to crt filenames --- volatility/plugins/windows/registry/certificates.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility/plugins/windows/registry/certificates.py index 0c43fd882..553166583 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility/plugins/windows/registry/certificates.py @@ -54,7 +54,8 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - filedata = interfaces.plugins.FileInterface("{} - {}.crt".format(reg_section, key_hash)) + filedata = interfaces.plugins.FileInterface( + "{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, key_hash)) filedata.data.write(certificate_data) self.produce_file(filedata) yield (0, (top_key, reg_section, key_hash, name))