diff --git a/volatility/framework/renderers/conversion.py b/volatility/framework/renderers/conversion.py index c570c124f..bae2524bf 100644 --- a/volatility/framework/renderers/conversion.py +++ b/volatility/framework/renderers/conversion.py @@ -109,3 +109,15 @@ def convert_network_four_tuple(family, four_tuple): ret = None return ret + + +class StringlikeData(str): + """Container for data that's supposed to be a string but could in fact be binary data""" + + def __init__(self, original: bytes, encoding: str = 'utf-16-le'): + self.original = original + self._encoding = encoding + str.__init__(self) + + def __str__(self): + return str(self.original, encoding = self._encoding, errors = 'replace').split("\x00")[0] diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index 76e8c5ea6..2cc90c578 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -5,10 +5,11 @@ import enum import logging import struct -from typing import Optional, Iterable +from typing import Optional, Iterable, Union from volatility.framework import constants, exceptions, objects, interfaces from volatility.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException +from volatility.framework.renderers import conversion vollog = logging.getLogger(__name__) @@ -239,7 +240,7 @@ class CM_KEY_VALUE(objects.StructType): self.Name.count = namelength return self.Name.cast("string", max_length = namelength, encoding = "latin-1") - def decode_data(self) -> bytes: + def decode_data(self) -> Union[str, bytes]: """Properly decodes the data associated with the value node""" # Determine if the data is stored inline datalen = self.DataLength @@ -288,13 +289,16 @@ class CM_KEY_VALUE(objects.StructType): raise ValueError("Size of data does not match the type of registry value {}".format(self.get_name())) return struct.unpack("