From 996875c059bd8f817e98a40bd7e782070798275d Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 7 Oct 2024 16:13:12 -0500 Subject: [PATCH] #1298 - include hive name in key path --- volatility3/framework/plugins/windows/registry/printkey.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 180f8f9d9f..4fe3f97fb8 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -20,7 +20,7 @@ class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -282,7 +282,7 @@ def _registry_walker( renderers.UnreadableValue(), format_hints.Hex(hive.hive_offset), "Key", - "?\\" + (key or ""), + f"{hive.get_name()}\\" + (key or ""), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(),