(self, hive: RegistryHive)
Generate userassist data for a registry hive.
Generate userassist data for a registry hive.
Generate userassist data for a registry hive .
def list_userassist(self, hive: RegistryHive) -> Generator[Tuple[int, Tuple], None, None]:
        """Generate userassist data for a registry hive."""

        hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name()

        if self._win7 is None:
            try:
                self._win7 = self._win7_or_later()
            except exceptions.SymbolError:
                # self._win7 will be None and only registry value rawdata will be output
                pass

        self._determine_userassist_type()

        userassist_node_path = hive.get_key("software\\microsoft\\windows\\currentversion\\explorer\\userassist",
                                            return_list = True)

        if not userassist_node_path:
            vollog.warning("list_userassist did not find a valid node_path (or None)")
            return

        if not isinstance(userassist_node_path, list):
            vollog.warning("userassist_node_path did not return a list as expected")
            return
        userassist_node = userassist_node_path[-1]
        # iterate through the GUIDs under the userassist key
        for guidkey in userassist_node.get_subkeys():
            # each guid key should have a Count key in it
            for countkey in guidkey.get_subkeys():
                countkey_path = countkey.get_key_path()
                countkey_last_write_time = conversion.wintime_to_datetime(countkey.LastWriteTime.QuadPart)

                # output the parent Count key
                result = (
                    0, (renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path,
                        countkey_last_write_time, "Key", renderers.NotApplicableValue(), renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(), renderers.NotApplicableValue())
                )  # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]]
                yield result

                # output any subkeys under Count
                for subkey in countkey.get_subkeys():

                    subkey_name = subkey.get_name()
                    result = (1, (
                        renderers.format_hints.Hex(hive.hive_offset),
                        hive_name,
                        countkey_path,
                        countkey_last_write_time,
                        "Subkey",
                        subkey_name,
                        renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(),
                        renderers.NotApplicableValue(),
                    ))
                    yield result

                # output any values under Count
                for value in countkey.get_values():

                    value_name = value.get_name()
                    try:
                        value_name = codecs.encode(value_name, "rot_13")
                    except UnicodeDecodeError:
                        pass

                    if self._win7:
                        guid = value_name.split("\\")[0]
                        if guid in self._folder_guids:
                            value_name = value_name.replace(guid, self._folder_guids[guid])

                    userassist_data_dict = self.parse_userassist_data(value)
                    result = (1, (
                        renderers.format_hints.Hex(hive.hive_offset),
                        hive_name,
                        countkey_path,
                        countkey_last_write_time,
                        "Value",
                        value_name,
                        userassist_data_dict["id"],
                        userassist_data_dict["count"],
                        userassist_data_dict["focus"],
                        userassist_data_dict["time"],
                        userassist_data_dict["lastupdated"],
                        format_hints.HexBytes(userassist_data_dict["rawdata"]),
                    ))
                    yield result
def list_userassist ( self , hive : RegistryHive ) -> Generator [ Tuple [ int , Tuple ] , None , None ] : hive_name = hive . hive . cast ( self . config [ "nt_symbols" ] + constants . BANG + "_CMHIVE" ) . get_name ( ) if self . _win7 is None : try : self . _win7 = self . _win7_or_later ( ) except exceptions . SymbolError : # self._win7 will be None and only registry value rawdata will be output pass self . _determine_userassist_type ( ) userassist_node_path = hive . get_key ( "software\\microsoft\\windows\\currentversion\\explorer\\userassist" , return_list = True ) if not userassist_node_path : vollog . warning ( "list_userassist did not find a valid node_path (or None)" ) return if not isinstance ( userassist_node_path , list ) : vollog . warning ( "userassist_node_path did not return a list as expected" ) return userassist_node = userassist_node_path [ - 1 ] # iterate through the GUIDs under the userassist key for guidkey in userassist_node . get_subkeys ( ) : # each guid key should have a Count key in it for countkey in guidkey . get_subkeys ( ) : countkey_path = countkey . get_key_path ( ) countkey_last_write_time = conversion . wintime_to_datetime ( countkey . LastWriteTime . QuadPart ) # output the parent Count key result = ( 0 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Key" , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) ) ) # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]] yield result # output any subkeys under Count for subkey in countkey . get_subkeys ( ) : subkey_name = subkey . get_name ( ) result = ( 1 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Subkey" , subkey_name , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , ) ) yield result # output any values under Count for value in countkey . get_values ( ) : value_name = value . get_name ( ) try : value_name = codecs . encode ( value_name , "rot_13" ) except UnicodeDecodeError : pass if self . _win7 : guid = value_name . split ( "\\" ) [ 0 ] if guid in self . _folder_guids : value_name = value_name . replace ( guid , self . _folder_guids [ guid ] ) userassist_data_dict = self . parse_userassist_data ( value ) result = ( 1 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Value" , value_name , userassist_data_dict [ "id" ] , userassist_data_dict [ "count" ] , userassist_data_dict [ "focus" ] , userassist_data_dict [ "time" ] , userassist_data_dict [ "lastupdated" ] , format_hints . HexBytes ( userassist_data_dict [ "rawdata" ] ) , ) ) yield result