From f3cb0464a3a3cd28e693e9ad6c4898f670049f89 Mon Sep 17 00:00:00 2001
From: gleeda <jamie@memoryanalysis.net>
Date: Wed, 30 Jul 2014 16:30:53 -0400
Subject: [PATCH] registry pointers should be 32bit.  also adding check to make
 sure Parent key is correct

---
 volatility/plugins/overlays/windows/windows.py | 6 +++---
 volatility/win32/rawreg.py                     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/volatility/plugins/overlays/windows/windows.py b/volatility/plugins/overlays/windows/windows.py
index 2d7ba990..f2f3e68c 100644
--- a/volatility/plugins/overlays/windows/windows.py
+++ b/volatility/plugins/overlays/windows/windows.py
@@ -106,7 +106,7 @@ windows_overlay = {
     'Signature' : [ None, ['String', dict(length = 2)]],
     'LastWriteTime' : [ None, ['WinTimeStamp', dict(is_utc = True)]],
     'Name' : [ None, ['String', dict(length = lambda x: x.NameLength)]],
-    'Parent': [ None, ['pointer', ['_CM_KEY_NODE']]],
+    'Parent': [ None, ['pointer32', ['_CM_KEY_NODE']]],
     }],
 
     '_CM_NAME_CONTROL_BLOCK' : [ None, {
@@ -114,7 +114,7 @@ windows_overlay = {
     }],
 
     '_CHILD_LIST' : [ None, {
-    'List' : [ None, ['pointer', ['array', lambda x: x.Count,
+    'List' : [ None, ['pointer32', ['array', lambda x: x.Count,
                                  ['pointer32', ['_CM_KEY_VALUE']]]]],
     }],
 
@@ -125,7 +125,7 @@ windows_overlay = {
 
     '_CM_KEY_INDEX' : [ None, {
     'Signature' : [ None, ['String', dict(length = 2)]],
-    'List' : [ None, ['array', lambda x: x.Count.v() * 2, ['pointer', ['_CM_KEY_NODE']]]],
+    'List' : [ None, ['array', lambda x: x.Count.v() * 2, ['pointer32', ['_CM_KEY_NODE']]]],
     }],
 
     'PO_MEMORY_IMAGE' : [ None, {
diff --git a/volatility/win32/rawreg.py b/volatility/win32/rawreg.py
index d62aa043..148d8c65 100644
--- a/volatility/win32/rawreg.py
+++ b/volatility/win32/rawreg.py
@@ -120,7 +120,7 @@ def subkeys(key):
             pass
         else:
             for i in read_sklist(sk):
-                if i.Signature.v() == NK_SIG:
+                if i.Signature.v() == NK_SIG and i.Parent.dereference().Name == key.Name:
                     yield i
 
     if int(key.SubKeyCounts[1]) > 0:
@@ -130,7 +130,7 @@ def subkeys(key):
             pass
         else:
             for i in read_sklist(sk):
-                if i and i.Signature.v() == NK_SIG:
+                if i and i.Signature.v() == NK_SIG and i.Parent.dereference().Name == key.Name:
                     yield i
 
 def values(key):