i get error message when use printkey
Output:
./vol.py -f xp.mem --profile=WinXPSP2x86 printkey -K
"Microsoft\Windows\CurrentVersion\Run"
Volatility Foundation Volatility Framework 2.3.1
Legend: (S) = Stable (V) = Volatile
----------------------------
Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\software
Key name: Run (S)
Last updated: 2013-11-10 14:44:22 UTC+0000
Subkeys:
Values:
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 5, in <module>
pkg_resources.run_script('volatility==2.3.1', 'vol.py')
File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 499, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 1235, in run_script
execfile(script_filename, namespace, namespace)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 184, in <module>
main()
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 175, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 122, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/registry/printkey.py", line 95, in render_text
for reg, key in data:
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/registry/printkey.py", line 85, in calculate
yield name, rawreg.open_key(root, self._config.KEY.split('\\'))
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/win32/rawreg.py", line 89, in open_key
debug.debug("Couldn't find subkey {0} of {1}".format(keyname, root.Name), 1)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/basic.py", line 95, in __format__
return format(self.__str__(), formatspec)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/basic.py", line 86, in __str__
return unicode(self).encode('ascii', 'replace') or ""
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/basic.py", line 92, in __unicode__
return self.v().decode(self.encoding, 'replace').split("\x00", 1)[0] or u''
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/basic.py", line 70, in v
result = self.obj_vm.zread(self.obj_offset, self.length)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/win32/hive.py", line 150, in zread
return self.read(addr, length, True)
File "/usr/local/lib/python2.7/dist-packages/volatility-2.3.1-py2.7.egg/volatility/win32/hive.py", line 146, in read
stuff_read = stuff_read + self.base.read(paddr, left_over)
TypeError: cannot concatenate 'str' and 'NoneType' objects
What version of the product are you using? On what operating system?
volatility 2.3.1 in ubuntu 12.04
Original issue reported on code.google.com by junkcoo...@gmail.com on 9 Dec 2013 at 3:52
Original issue reported on code.google.com by
junkcoo...@gmail.com
on 9 Dec 2013 at 3:52