From 481ea01149d19d844c456f191e2bd10b12d19c14 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 6 Jun 2018 16:32:13 -0500 Subject: [PATCH] catch the KeyError so we can iterate over all hives for a key path --- volatility/plugins/windows/printkey.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index ad0bd53e5..ab3244a3f 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -103,7 +103,11 @@ def registry_walker(self): # Walk it if 'key' in self.config: - node_path = hive.get_key(self.config['key'], return_list = True) + try: + node_path = hive.get_key(self.config['key'], return_list=True) + except KeyError: + vollog.debug("Key {} not found in Hive at offset {}.".format(self.config['key'], hex(hive_offset))) + continue else: node_path = [hive.get_node(hive.root_cell_offset)] yield from self.hive_walker(hive, node_path)