We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
2 parents 806801e + fcaba2d commit 104623eCopy full SHA for 104623e
volatility3/framework/layers/registry.py
@@ -171,7 +171,15 @@ def get_key(
171
node (default) or a list of nodes from root to the current node
172
(if return_list is true).
173
"""
174
- node_key = [self.get_node(self.root_cell_offset)]
+ root_node = self.get_node(self.root_cell_offset)
175
+ if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"):
176
+ raise RegistryFormatException(
177
+ self.name,
178
+ "Encountered {} instead of _CM_KEY_NODE".format(
179
+ root_node.vol.type_name
180
+ ),
181
+ )
182
+ node_key = [root_node]
183
if key.endswith("\\"):
184
key = key[:-1]
185
key_array = key.split("\\")
0 commit comments