From f040ceed96209703bae8b09a467c864e0d705c61 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 1 Sep 2019 16:10:58 +0100 Subject: [PATCH] Ensure keys and values are at the same level. --- volatility/framework/plugins/windows/registry/printkey.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index cf1330103..234e084e8 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -131,6 +131,10 @@ class PrintKey(interfaces.plugins.PluginInterface): else: node_path = [hive.get_node(hive.root_cell_offset)] for (x, y) in self.hive_walker(hive, node_path, recurse = self.config.get('recurse', None)): + (_, _, value_type, _, _, _, _) = y + if value_type != 'key': + # Values are classed as one node deeper than subkeys, but we want them at the same level + x -= 1 yield (x - len(node_path), y) except (exceptions.InvalidAddressException, KeyError, RegistryFormatException) as excp: