Skip to content

Commit 27ea555

Browse files
committed
Add product version to output columns
1 parent dec0d50 commit 27ea555

File tree

1 file changed

+6
-10
lines changed

1 file changed

+6
-10
lines changed

volatility3/framework/plugins/windows/amcache.py

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -357,13 +357,7 @@ def parse_programs_key(
357357
install_time = _get_datetime_utc_epoch_value(
358358
values, val_enum.InstallTime.value
359359
)
360-
_version = _get_string_value(values, val_enum.Version.value)
361-
362-
if isinstance(_version, str):
363-
if isinstance(product, str):
364-
product = f"{product} {_version}"
365-
else:
366-
product = f"UNKNOWN {_version}"
360+
version = _get_string_value(values, val_enum.Version.value)
367361

368362
yield program_id, _AmcacheEntry(
369363
AmcacheEntryType.Program.name,
@@ -373,6 +367,7 @@ def parse_programs_key(
373367
),
374368
install_time=install_time,
375369
product_name=product,
370+
product_version=version,
376371
)
377372

378373
@classmethod
@@ -494,11 +489,11 @@ def parse_driver_binary_key(
494489

495490
# Depending on the Windows version, the key name will be either the name
496491
# of the driver, or its SHA1 hash.
497-
if "/" in binary_key.get_name():
498-
driver_name = binary_key.get_name()
492+
if "/" in str(binary_key.get_name()):
493+
driver_name = str(binary_key.get_name())
499494
sha1_hash = _get_string_value(values, val_enum.DriverId.name)
500495
else:
501-
sha1_hash = binary_key.get_name()
496+
sha1_hash = str(binary_key.get_name())
502497
driver_name = _get_string_value(values, val_enum.DriverName.name)
503498

504499
if isinstance(sha1_hash, str):
@@ -646,6 +641,7 @@ def run(self):
646641
("SHA1", str),
647642
("Service", str),
648643
("ProductName", str),
644+
("ProductVersion", str),
649645
],
650646
(
651647
(indent, dataclasses.astuple(entry))

0 commit comments

Comments
 (0)