X fx.ddlZddlZddlmZmZmZmZmZddlm Z m Z m Z m Z m Z ddlmZddlmZmZddlmZmZmZddlmZddlmZejeZGd d e jjZ dS) N)ListSequenceIterableTupleUnion)objects renderers exceptions interfaces constants) requirements) RegistryHiveRegistryFormatException)TreeGrid conversion format_hints) RegValueTypes)hivelistcBeZdZdZdZdZedeej j fdZ e dde d e ejd edeeeeejeeejjffd Z dde d e ejd efd Z dd ededeeded ef dZdZdS)PrintKeyz;Lists the registry keys under a hive or specific key value.)rrrrreturnc tjddddgtjdtjdtjd d dd tjd ddd tjdddd gS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)rpluginversionoffset Hive OffsetT)rr defaultoptionalkeyzKey to start fromrecursezRecurses through keysF)r ModuleRequirementPluginRequirementrHiveListIntRequirementStringRequirementBooleanRequirement)clss i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/printkey.pyget_requirementszPrintKey.get_requirementss  *,()4     *(99     '=$QU     *(;TTX     +3      NFhive node_pathr)c# K|s||jg}t|trt |dkrt ddS|d}|g|ddz}dd|D}|jj tj dzrt|jdtj|jj}|D]}t |d ||||f} | V|r|jjd |Dvrn |n6#t.j$r$} t | Yd} ~ d} ~ wwxYw||||gz| Ed{V|D]-} t |d |||| f} | V.dS) aWalks through a set of nodes from a given node (last one in node_path). Avoids loops by not traversing into nodes already present in the node_path. Args: hive: The registry hive to walk node_path: The list of nodes that make up the recurse: Traverse down the node tree or stay only on the same level Yields: A tuple of results (depth, is_key, last write time, path, volatile, and the node). rz6Hive walker was not passed a valid node_path (or None)N\c6g|]}|S)get_name).0ks r1 z)PrintKey.key_iterator..Ps CCCqajjllCCCr3 _CELL_DATAz.Encountered _CELL_DATA instead of _CM_KEY_NODETc&g|]}|jjSr:)volr$)r<xs r1r>z)PrintKey.key_iterator..cs.O.O.Oqu|.O.O.Or3r)F)get_noderoot_cell_offset isinstancelistlenvollogwarningjoinrA type_nameendswithr BANGrrrwintime_to_datetime LastWriteTimeQuadPart get_subkeys get_volatiler$r;r InvalidAddressExceptiondebug key_iterator get_values) r0r4r5r)nodekey_path_itemskey_pathlast_write_timekey_noderesultexcp value_nodes r1rVzPrintKey.key_iterator2sl. ?t'<==>I)T** c)nnq.@.@ NNS T T T4})ABB-/99CCNCCCDD 8  & &y~ 'D E E ) K %89K9TUU((**  HI%%'' FLLL <&.O.OY.O.O.OOO! ))++++%=!!! T*** ! #//i8*4g 0  //++  JI!!## FLLLL  sE))F8FFc #K||||D]?\}}}}}} |r | } nP#tjtf$r7} t | tj} Yd} ~ nd} ~ wwxYwtj | j j }||tj |jd|| tj|ffV | pd} nP#tjtf$r7} t | tj} Yd} ~ nd} ~ wwxYw t#| jj} nP#tjtf$r7} t | tj} Yd} ~ nd} ~ wwxYwt)| tjr/t dtj}n! | }t)|t,rtj|d}nt#| jt"jkrtj|d}nPt#| jt"jkrtj|d d }ntj|d }nV#t4tjtf$r7} t | tj}Yd} ~ nd} ~ wwxYw||tj |j| || ||ff}|VAdS) aMethod that wraps the more generic key_iterator, to provide output for printkey specifically. Args: hive: The registry hive to walk node_path: The list of nodes that make up the recurse: Traverse down the node tree or stay only on the same level Yields: The depth, and a tuple of results (last write time, hive offset, type, path, name, data and volatile) NKeyz (Default)z8Couldn't read registry value type, so data is unreadablezutf-8)encodingT)show_hexz utf-16-le)rb split_nulls)rVr;r rTrrIrUr UnreadableValuerrOrPrQrHex hive_offsetNotApplicableValuerTyperrF decode_dataint MultiTypeData REG_BINARY REG_MULTI_SZ ValueError)selfr4r5r)depthis_keyr[rZvolatilerX key_node_namer^value_node_name value_type value_datar]s r1_printkey_iteratorzPrintKey._printkey_iteratorys0  tY 8 8e e       ] @$(MMOOMM6+@@@LL&&&$-$=$?$?MMMMMM @#-"@&/## '!.2243CDD %!466      B&*mmoo&DOO6+BBBLL&&&&/&?&A&AOOOOOO B=!.ty!9!9!>JJ6+===LL&&&!*!:!%@%@ A'!.2243CDD" '"   Ke e s^<B -BB ,DE-E  EE..F;-F66F;C KL%.-L  L% layer_name symbol_table hive_offsetsr(c #Ktj|j|j|||D]} |||d}n||jg}||||D]\}} |t|z | fVn#tj ttf$r<} t| tr4td|dt#|jdnyt| trt| nIt| tj r/tdt#| jd t)jt-j|jd d |pd zt)jt)jt)jff} | VYd} ~ d} ~ wwxYwdS) N)ryrzr{T) return_listrCzKey 'z' not found in Hive at offset .z$Invalid address identified in Hive: rraz?\)rr, list_hivescontext config_pathget_keyrDrErxrHr rTKeyErrorrrFrIrUhexrginvalid_addressr rerrf) rpryrzr{r(r)r4r5rByr^r]s r1_registry_walkerzPrintKey._registry_walkers1%00 L  !%% 1  * * D# ? $ Sd C CII!%t/D!E!E FI 33D)W3UU22DAqs9~~-q1111122'    dH-- LL[[[3tGWCXCX[[[ &=>>LL&&&&j&HIILLZs4CW?X?XZZ!133$()9::+!133!133!133  7 * * sA)BG8&S!T   [ 037 DDDG./D D  x(#tZ5G5W W   DDD[DR37 vvvG./v vvvvx#' 22223i 2  2  2222h     r3r)!rloggingtypingrrrrrvolatility3.frameworkrr r r r #volatility3.framework.configurationr %volatility3.framework.layers.registryrrvolatility3.framework.renderersrrr9volatility3.framework.symbols.windows.extensions.registryr$volatility3.plugins.windows.registryr getLoggerrrIpluginsPluginInterfacerr:r3r1rs/ 99999999999999WWWWWWWWWWWWWW<<<<<<WWWWWWWWNNNNNNNNNNSSSSSS999999  8 $ $g g g g g z!1g g g g g r3