From f3871f3822db83ea4f49bef50aeb45e4c839eb8a Mon Sep 17 00:00:00 2001 From: gleeda Date: Fri, 30 Nov 2012 21:38:20 +0000 Subject: [PATCH] Fixed so that we don't print out the list head as a possible hive. For details see: http://moyix.blogspot.com/2008/02/enumerating-registry-hives.html --- volatility/plugins/registry/hivelist.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/registry/hivelist.py b/volatility/plugins/registry/hivelist.py index ed0a01c3..6a79aceb 100644 --- a/volatility/plugins/registry/hivelist.py +++ b/volatility/plugins/registry/hivelist.py @@ -58,7 +58,7 @@ class HiveList(hs.HiveScan): hive_offsets = [] for hive in result: - if hive.obj_offset not in hive_offsets: + if hive.Hive.Signature == 0xbee0bee0 and hive.obj_offset not in hive_offsets: try: name = str(hive.FileFullPath or '') or str(hive.FileUserName or '') or str(hive.HiveRootPath or '') or "[no name]" except AttributeError: