Skip to content

Commit 104623e

Browse files
authored
Merge pull request #1018 from volatilityfoundation/1017-printkey-breaks-when-encountering-invalid-root-node
issue #1017 - check for valid root node type
2 parents 806801e + fcaba2d commit 104623e

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

volatility3/framework/layers/registry.py

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,15 @@ def get_key(
171171
node (default) or a list of nodes from root to the current node
172172
(if return_list is true).
173173
"""
174-
node_key = [self.get_node(self.root_cell_offset)]
174+
root_node = self.get_node(self.root_cell_offset)
175+
if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"):
176+
raise RegistryFormatException(
177+
self.name,
178+
"Encountered {} instead of _CM_KEY_NODE".format(
179+
root_node.vol.type_name
180+
),
181+
)
182+
node_key = [root_node]
175183
if key.endswith("\\"):
176184
key = key[:-1]
177185
key_array = key.split("\\")

0 commit comments

Comments
 (0)