vfsList API not returning the expected data

[msilva-basis]

Version: v5.11.7

I am running into an issue when trying to list the contents of the /registry/HKLM directory using the API. I have seen the same issue with both the Python and the Java API.

Python example:

import memprocfs

vmm = memprocfs.Vmm(['-device', 'C:\\memory_images\\win10.raw'])

vfs_file_list = vmm.vfs.list('/registry/HKLM/')
for file_name in vfs_file_list:
    print(file_name)

Output of the python example (last 15 lines):

.all
.adts
.adt
.ac3
.amr
.aac
.3mf
.3gpp
.3gp2
.3gp
.3g2
.3fr
_
(_Key_).txt
(_Key_)

This API call will output a different list of files than I see when running from the command line and viewing the mounted directory: M:\registry\HKLM. I expected the list to be the same.

[ufrisk]

Thank you for reporting this. I quite don't understand why it's happening.

You have a slash at the end of the path though. Remove it an things should work as they should.

Now, it's quite strange that you get the file listings of the classes hive when you add the slash to the end of the path, I'll look into it even though the issue can be resolved by removing it.