- Fixed an issue causing the generation of an invalid, extra symbol.
- Reuse ELF sym API instead of reimplemented it
- Updated the function to return the symbol index, enabling the use of additional module tables.
- Ensured the ELF symbol object has `cached_strtab` set, allowing retrieval of critical symbol information like names.
- Added typing hints
All other methods in this class raise a `TypeError` if the hive was not
instantiated on a registry layer; this changes makes this method
consistent with the convention used in the others.
All `except` blocks checking for `ValueError` have been audited to
ensure that this doesn't break exception handling in existing code
within the framework. This also includes a minor version bump because:
1. RegistryHives are currently only instantiated one way, which is
through the `hivelist` plugin. `hivelist` uses the correct layers when
instantiating the hives.
2. Because there is currently a single source for registry hives, and
it's unlikely that a hive from that source will ever be created on
the wrong layer, it's unlikely that the existing `ValueError` is
being raised anywhere within the framework's code.
3. It seems unlikely that consumers of this framework would be
instantiating registry hives independent of the `hivelist` plugin,
given that they would effectively have to duplicate the `hivelist`
code to do so.
For these reasons, we're going to do a minor version bump, even though
an argument can be made that this warrants a major version bump
according to the SemVer rules. This is a one-off and does not indicate
any change in the way that we typically update version numbers.
These calls to `.read()` can raise an `InvalidAddressException`. Instead
of propagating this exception to the caller, this adds debug logging,
and pads the data will null bytes.
Also updates the docstring for `decode_data()` to indicate that it can
raise `TypeError` and `ValueError`.
This fixes an unbound local used in a debug message; If the exception is
raised during the dereference operation, the `objct` variable may be
uninitialized. This uses the offset of `ptr` instead.
Any number of member accesses here can raise an
`InvalidAddressException`; each is now checked, and `None` returned if
any `InvalidAddressException` occurs.
A number of calls to `get_key` across multiple plugins are not made
within a `try/except` block that handles
`registry.RegistryFormatException` - the calls are either unprotected or
only check for `KeyError`. This adds the required `try/except` blocks,
or updates the existing ones as needed.
