parameters: (self, hive: RegistryHive)
docstring: Generate userassist data for a registry hive.
docstring_summary: Generate userassist data for a registry hive.
docstring_tokens: Generate userassist data for a registry hive .
function: def list_userassist(self, hive: RegistryHive) -> Generator[Tuple[int, Tuple], None, None]:
          """Generate userassist data for a registry hive."""
  
          hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name()
  
          if self._win7 is None:
              try:
                  self._win7 = self._win7_or_later()
              except exceptions.SymbolError:
                  # self._win7 will be None and only registry value rawdata will be output
                  pass
  
          self._determine_userassist_type()
  
          userassist_node_path = hive.get_key("software\\microsoft\\windows\\currentversion\\explorer\\userassist",
                                              return_list = True)
  
          if not userassist_node_path:
              vollog.warning("list_userassist did not find a valid node_path (or None)")
              return
  
          if not isinstance(userassist_node_path, list):
              vollog.warning("userassist_node_path did not return a list as expected")
              return
          userassist_node = userassist_node_path[-1]
          # iterate through the GUIDs under the userassist key
          for guidkey in userassist_node.get_subkeys():
              # each guid key should have a Count key in it
              for countkey in guidkey.get_subkeys():
                  countkey_path = countkey.get_key_path()
                  countkey_last_write_time = conversion.wintime_to_datetime(countkey.LastWriteTime.QuadPart)
  
                  # output the parent Count key
                  result = (
                      0, (renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path,
                          countkey_last_write_time, "Key", renderers.NotApplicableValue(), renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(), renderers.NotApplicableValue())
                  )  # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]]
                  yield result
  
                  # output any subkeys under Count
                  for subkey in countkey.get_subkeys():
  
                      subkey_name = subkey.get_name()
                      result = (1, (
                          renderers.format_hints.Hex(hive.hive_offset),
                          hive_name,
                          countkey_path,
                          countkey_last_write_time,
                          "Subkey",
                          subkey_name,
                          renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(),
                          renderers.NotApplicableValue(),
                      ))
                      yield result
  
                  # output any values under Count
                  for value in countkey.get_values():
  
                      value_name = value.get_name()
                      try:
                          value_name = codecs.encode(value_name, "rot_13")
                      except UnicodeDecodeError:
                          pass
  
                      if self._win7:
                          guid = value_name.split("\\")[0]
                          if guid in self._folder_guids:
                              value_name = value_name.replace(guid, self._folder_guids[guid])
  
                      userassist_data_dict = self.parse_userassist_data(value)
                      result = (1, (
                          renderers.format_hints.Hex(hive.hive_offset),
                          hive_name,
                          countkey_path,
                          countkey_last_write_time,
                          "Value",
                          value_name,
                          userassist_data_dict["id"],
                          userassist_data_dict["count"],
                          userassist_data_dict["focus"],
                          userassist_data_dict["time"],
                          userassist_data_dict["lastupdated"],
                          format_hints.HexBytes(userassist_data_dict["rawdata"]),
                      ))
                      yield result
function_tokens: def list_userassist ( self , hive : RegistryHive ) -> Generator [ Tuple [ int , Tuple ] , None , None ] : hive_name = hive . hive . cast ( self . config [ "nt_symbols" ] + constants . BANG + "_CMHIVE" ) . get_name ( ) if self . _win7 is None : try : self . _win7 = self . _win7_or_later ( ) except exceptions . SymbolError : # self._win7 will be None and only registry value rawdata will be output pass self . _determine_userassist_type ( ) userassist_node_path = hive . get_key ( "software\\microsoft\\windows\\currentversion\\explorer\\userassist" , return_list = True ) if not userassist_node_path : vollog . warning ( "list_userassist did not find a valid node_path (or None)" ) return if not isinstance ( userassist_node_path , list ) : vollog . warning ( "userassist_node_path did not return a list as expected" ) return userassist_node = userassist_node_path [ - 1 ] # iterate through the GUIDs under the userassist key for guidkey in userassist_node . get_subkeys ( ) : # each guid key should have a Count key in it for countkey in guidkey . get_subkeys ( ) : countkey_path = countkey . get_key_path ( ) countkey_last_write_time = conversion . wintime_to_datetime ( countkey . LastWriteTime . QuadPart ) # output the parent Count key result = ( 0 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Key" , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) ) ) # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]] yield result # output any subkeys under Count for subkey in countkey . get_subkeys ( ) : subkey_name = subkey . get_name ( ) result = ( 1 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Subkey" , subkey_name , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , renderers . NotApplicableValue ( ) , ) ) yield result # output any values under Count for value in countkey . get_values ( ) : value_name = value . get_name ( ) try : value_name = codecs . encode ( value_name , "rot_13" ) except UnicodeDecodeError : pass if self . _win7 : guid = value_name . split ( "\\" ) [ 0 ] if guid in self . _folder_guids : value_name = value_name . replace ( guid , self . _folder_guids [ guid ] ) userassist_data_dict = self . parse_userassist_data ( value ) result = ( 1 , ( renderers . format_hints . Hex ( hive . hive_offset ) , hive_name , countkey_path , countkey_last_write_time , "Value" , value_name , userassist_data_dict [ "id" ] , userassist_data_dict [ "count" ] , userassist_data_dict [ "focus" ] , userassist_data_dict [ "time" ] , userassist_data_dict [ "lastupdated" ] , format_hints . HexBytes ( userassist_data_dict [ "rawdata" ] ) , ) ) yield result