registry.py 文件源码

python
阅读 30 收藏 0 点赞 0 评论 0

项目:rvmi-rekall 作者: fireeye 项目源码 文件源码
def __init__(self, filename=None, **kwargs):
        filename = common.FileSpec(filename, filesystem="Reg", path_sep="\\")
        super(RegistryKeyInformation, self).__init__(
            filename=filename, **kwargs)
        self.hive = self.key_name = self.value_name = self.value = ""
        self.value_type = "REG_NONE"
        self.st_mode = stat.S_IFDIR

        path_components = self.filename.components()
        if not path_components:
            return

        # The first component MUST be a hive
        self.hive = path_components[0]
        self._hive_handle = KeyHandle(getattr(_winreg, self.hive, None))
        if self._hive_handle is None:
            raise IOError("Unknown hive name %s" % self.hive)

        # Maybe its a key.
        try:
            self._read_key(path_components)
        except exceptions.WindowsError:
            # Nop - maybe its a value then.
            self._read_value(path_components)
评论列表
文章目录


问题


面经


文章

微信
公众号

扫码关注公众号