Hey guys, when trying to use printkey I got this error:
$ python volatility.py printkey -o OFFSET -f MEM.DMP
Volatile Systems Volatility Framework 1.4_rc1
Traceback (most recent call last):
File "volatility.py", line 126, in <module>
main()
File "volatility.py", line 117, in main
command.execute()
File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/commands.py", line 77, in execute
# with backslash.
File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/plugins/registry/printkey.py", line 82, in calculate
File "/Users/mike/Desktop/Volatility-1.4_rc1/volatility/win32/hive.py", line 47, in __init__
TypeError: __init__() takes exactly 3 arguments (2 given)
So we just need to change hive.py like this:
class HiveAddressSpace(addrspace.BaseAddressSpace):
def __init__(self, config, baseAddressSpace, hive_addr):
addrspace.BaseAddressSpace.__init__(self, baseAddressSpace, config)
And then alter printkey.py:
hive = hivemod.HiveAddressSpace(self._config, addr_space,
self._config.hive_offset)
The same may also need to be done for lsadump.
Original issue reported on code.google.com by michael.hale@gmail.com on 9 Dec 2010 at 10:16
Original issue reported on code.google.com by
michael.hale@gmail.com
on 9 Dec 2010 at 10:16