Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

All calls to get_name on registry keys need auditing #1476

Open
atcuno opened this issue Dec 27, 2024 · 0 comments
Open

All calls to get_name on registry keys need auditing #1476

atcuno opened this issue Dec 27, 2024 · 0 comments
Assignees

Comments

@atcuno
Copy link
Contributor

atcuno commented Dec 27, 2024

The scheduled task plugin crashed on many samples here:

24-12-26 13:29:01 volatility3.cli DEBUG    Traceback (most recent call last):
  File "/home/ub/volatility3/volatility3/cli/__init__.py", line 501, in run
    renderer.render(grid)
  File "/home/ub/volatility3/volatility3/cli/text_renderer.py", line 232, in render
    grid.populate(visitor, outfd)
  File "/home/ub/volatility3/volatility3/framework/renderers/__init__.py", line 241, in populate
    for level, item in self._generator:
  File "/home/ub/volatility3/volatility3/framework/plugins/windows/scheduled_tasks.py", line 1403, in <genexpr>
    (
  File "/home/ub/volatility3/volatility3/framework/plugins/windows/scheduled_tasks.py", line 1381, in _generator
    for task in self._parse_task_key(key, task_name_map):
  File "/home/ub/volatility3/volatility3/framework/plugins/windows/scheduled_tasks.py", line 1241, in _parse_task_key
    task_name = guid_mapping.get(str(key.get_name()), renderers.NotAvailableValue())
                                     ^^^^^^^^^^^^^^
  File "/home/ub/volatility3/volatility3/framework/symbols/windows/extensions/registry.py", line 251, in get_name
    return self.Name.cast("string", max_length=namelength, encoding="latin-1")
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

We need to fix this one + audit all calls to get_name to ensure they are in a try/except

@atcuno atcuno self-assigned this Dec 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant