Leor3961 / volatility

Automatically exported from code.google.com/p/volatility
0 stars 0 forks source link

HiveAddressSpace.__init__ needs to accept a config parameter #50

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
Hey guys, when trying to use printkey I got this error:

$ python volatility.py printkey -o OFFSET -f MEM.DMP

Volatile Systems Volatility Framework 1.4_rc1
Traceback (most recent call last):
  File "volatility.py", line 126, in <module>
    main()
  File "volatility.py", line 117, in main
    command.execute()
  File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/commands.py", line 77, in execute
    # with backslash.
  File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/plugins/registry/printkey.py", line 82, in calculate
  File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/win32/hive.py", line 47, in __init__
TypeError: __init__() takes exactly 3 arguments (2 given)

So we just need to change hive.py like this:

class HiveAddressSpace(addrspace.BaseAddressSpace):
    def __init__(self, config, baseAddressSpace, hive_addr):
        addrspace.BaseAddressSpace.__init__(self, baseAddressSpace, config)

And then alter printkey.py:

hive = hivemod.HiveAddressSpace(self._config, addr_space, 
self._config.hive_offset)

The same may also need to be done for lsadump. 

Original issue reported on code.google.com by michael.hale@gmail.com on 9 Dec 2010 at 10:16

GoogleCodeExporter commented 8 years ago
This issue was closed by revision r562.

Original comment by mike.auty@gmail.com on 10 Dec 2010 at 7:37