You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Many registry related plugins crash to due an error like this:
24-12-24 23:07:43 volatility3.cli DEBUG Traceback (most recent call last):
File "/home/ub/volatility3/volatility3/cli/__init__.py", line 501, in run
renderer.render(grid)
File "/home/ub/volatility3/volatility3/cli/text_renderer.py", line 232, in render
grid.populate(visitor, outfd)
File "/home/ub/volatility3/volatility3/framework/renderers/__init__.py", line 241, in populate
for level, item in self._generator:
File "/home/ub/volatility3/volatility3/framework/plugins/windows/registry/userassist.py", line 303, in _generator
yield from self.list_userassist(hive)
File "/home/ub/volatility3/volatility3/framework/plugins/windows/registry/userassist.py", line 170, in list_userassist
userassist_node_path = hive.get_key(
^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/registry.py", line 177, in get_key
raise RegistryFormatException(
volatility3.framework.layers.registry.RegistryFormatException: Encountered symbol_table_name1!_CELL_DATA instead of _CM_KEY_NODE
File "/home/ub/volatility3/volatility3/cli/__init__.py", line 501, in run
renderer.render(grid)
File "/home/ub/volatility3/volatility3/cli/text_renderer.py", line 232, in render
grid.populate(visitor, outfd)
File "/home/ub/volatility3/volatility3/framework/renderers/__init__.py", line 241, in populate
for level, item in self._generator:
File "/home/ub/volatility3/volatility3/plugins/windows/registry/certificates.py", line 86, in _generator
node_path = hive.get_key(top_key, return_list=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/registry.py", line 177, in get_key
raise RegistryFormatException(
volatility3.framework.layers.registry.RegistryFormatException: Encountered symbol_table_name1!_CELL_DATA instead of _CM_KEY_NODE
@superponible@dgmcdona - Are either of you familiar with _CELL_DATA? Is this a different data structure in certain versions of Windows? It crashes out any plugin that calls get_key when its present.
The text was updated successfully, but these errors were encountered:
We at least need to leave this with a definitive answer to document it, but I assume our code is just broken/out dated due to how many samples had this issue in testing.
Many registry related plugins crash to due an error like this:
@superponible @dgmcdona - Are either of you familiar with _CELL_DATA? Is this a different data structure in certain versions of Windows? It crashes out any plugin that calls
get_key
when its present.The text was updated successfully, but these errors were encountered: