From fdcab2760e8a5878ed61060c029a9caae218cccd Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 22 Nov 2017 16:03:55 -0600 Subject: [PATCH] change name of ntsymbols and call to get_key --- volatility/plugins/windows/printkey.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index 659ddae89..627f7399e 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -18,7 +18,7 @@ class PrintKey(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "ntsymbols", + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", @@ -91,8 +91,6 @@ class PrintKey(plugins.PluginInterface): self.context.memory.add_layer(hive) node = None - if self.config.get('key', None): - node = hive.get_key() # Walk it if 'key' in self.config: