mkorman90 / regipy

Regipy is an os independent python library for parsing offline registry hives
MIT License
241 stars 52 forks source link

Cannot iterate over subkeys in NTUSER.DAT\Software #251

Closed khyrenz closed 1 year ago

khyrenz commented 1 year ago

This fails for the user NTUSER.DAT hive in Win 11 image available at https://www.khyrenz.com/resources:

!/bin/python

import sys from regipy.registry import RegistryHive

Getting argument = NTUSER.DAT file - successful

reg = RegistryHive(sys.argv[1])

This correctly gets subkeys under NTUSER\Software

for sk in reg.get_key('Software').iter_subkeys(): print(sk.name)

This fails to find any subkeys under Software (e.g. Microsoft) despite above list showing keys exist

for subk in reg.get_key('Software\\'+sk.name).iter_subkeys():
    print(subk.name)

Error: Traceback (most recent call last): File "test.py", line 9, in for subk in reg.get_key('Software\'+sk.name).iter_subkeys(): File "/home/ubuntu/.local/lib/python3.8/site-packages/regipy/registry.py", line 228, in get_key raise RegistryKeyNotFoundException('Did not find subkey at {}'.format(key_path)) regipy.exceptions.RegistryKeyNotFoundException: Did not find subkey at Software\7-Zip