From f2029d56576a199472beba9b55cc6cf3c3da9d28 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Fri, 15 Jun 2018 22:20:16 -0500 Subject: [PATCH] add comment about registry key case sensitivity and re-work root_cell_offset --- volatility/framework/layers/registry.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 561e9da00..8dc956929 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -5,7 +5,7 @@ from volatility.framework import constants, exceptions, interfaces, objects from volatility.framework.configuration import requirements from volatility.framework.configuration.requirements import IntRequirement from volatility.framework.interfaces.configuration import TranslationLayerRequirement -from volatility.framework.exceptions import SwappedInvalidAddressException +from volatility.framework.exceptions import InvalidAddressException from volatility.framework.symbols import intermed from volatility.plugins.windows import pslist @@ -80,11 +80,12 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): def root_cell_offset(self) -> int: """Returns the offset for the root cell in this hive""" try: - if self._base_block.Length <= 0: + if self._base_block.Length > 0: + return self._base_block.RootCell + else: return 0x20 - except SwappedInvalidAddressException: + except InvalidAddressException: return 0x20 - return self._base_block.RootCell def get_cell(self, cell_offset: int) -> 'objects.Struct': """Returns the appropriate Cell value for a cell offset""" @@ -130,6 +131,8 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): while key_array and node_key: subkeys = node_key[-1].get_subkeys() for subkey in subkeys: + # registry keys are not case sensitive so compare lowercase + # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx if subkey.get_name().lower() == key_array[0].lower(): node_key = node_key + [subkey] found_key, key_array = found_key + [key_array[0]], key_array[1:]