admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

registry pointers should be 32bit. also adding check to make sure Parent key is correct

Browse Source
This commit is contained in:
gleeda
2014-07-30 16:30:53 -04:00
parent 344fb8b564
commit f3cb0464a3
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/overlays/windows/windows.py
+3 -3
View File
@@ -106,7 +106,7 @@ windows_overlay = {
'Signature' : [ None, ['String', dict(length = 2)]],
'LastWriteTime' : [ None, ['WinTimeStamp', dict(is_utc = True)]],
'Name' : [ None, ['String', dict(length = lambda x: x.NameLength)]],
'Parent': [ None, ['pointer', ['_CM_KEY_NODE']]],
'Parent': [ None, ['pointer32', ['_CM_KEY_NODE']]],
}],
'_CM_NAME_CONTROL_BLOCK' : [ None, {
@@ -114,7 +114,7 @@ windows_overlay = {
}],
'_CHILD_LIST' : [ None, {
'List' : [ None, ['pointer', ['array', lambda x: x.Count,
'List' : [ None, ['pointer32', ['array', lambda x: x.Count,
['pointer32', ['_CM_KEY_VALUE']]]]],
}],
@@ -125,7 +125,7 @@ windows_overlay = {
'_CM_KEY_INDEX' : [ None, {
'Signature' : [ None, ['String', dict(length = 2)]],
'List' : [ None, ['array', lambda x: x.Count.v() * 2, ['pointer', ['_CM_KEY_NODE']]]],
'List' : [ None, ['array', lambda x: x.Count.v() * 2, ['pointer32', ['_CM_KEY_NODE']]]],
}],
'PO_MEMORY_IMAGE' : [ None, {
volatility/win32/rawreg.py
+2 -2
View File
@@ -120,7 +120,7 @@ def subkeys(key):
pass
else:
for i in read_sklist(sk):
if i.Signature.v() == NK_SIG:
if i.Signature.v() == NK_SIG and i.Parent.dereference().Name == key.Name:
yield i
if int(key.SubKeyCounts[1]) > 0:
@@ -130,7 +130,7 @@ def subkeys(key):
pass
else:
for i in read_sklist(sk):
if i and i.Signature.v() == NK_SIG:
if i and i.Signature.v() == NK_SIG and i.Parent.dereference().Name == key.Name:
yield i
def values(key):