Hivelist/ Hivescan error

[Beercow]

After running the plugins, when you click on view hive keys, I get the following error:

ERROR Internal Server Error: /ajaxhandler/hivedetails/
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 149, in get_response
response = self.process_exception_by_middleware(e, request)
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 147, in get_response
response = wrapped_callback(request, _callback_args, *_callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(_args, *_kwargs)
File "/opt/VolUtility/web/views.py", line 922, in ajax_handler
hive_details = vol_int.run_plugin('hivedump', hive_offset=hive_offset)
File "/opt/VolUtility/web/vol_interface.py", line 270, in run_plugin
output_data = self.get_json(command)
File "/opt/VolUtility/web/vol_interface.py", line 179, in get_json
plugin.render_json(strio, plugin.calculate())
File "/usr/lib/python2.7/dist-packages/volatility/plugins/registry/printkey.py", line 206, in calculate
if not self._config.hive_offset:
File "/usr/lib/python2.7/dist-packages/volatility/conf.py", line 441, in getattr
raise AttributeError("Parameter {0} is not configured - try setting it on the command line (-h for help)".format(attr))
AttributeError: Parameter hive_offset is not configured - try setting it on the command line (-h for help)
ERROR : django.request : Internal Server Error: /ajaxhandler/hivedetails/
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 149, in get_response
response = self.process_exception_by_middleware(e, request)
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 147, in get_response
response = wrapped_callback(request, _callback_args, *_callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(_args, *_kwargs)
File "/opt/VolUtility/web/views.py", line 922, in ajax_handler
hive_details = vol_int.run_plugin('hivedump', hive_offset=hive_offset)
File "/opt/VolUtility/web/vol_interface.py", line 270, in run_plugin
output_data = self.get_json(command)
File "/opt/VolUtility/web/vol_interface.py", line 179, in get_json
plugin.render_json(strio, plugin.calculate())
File "/usr/lib/python2.7/dist-packages/volatility/plugins/registry/printkey.py", line 206, in calculate
if not self._config.hive_offset:
File "/usr/lib/python2.7/dist-packages/volatility/conf.py", line 441, in getattr
raise AttributeError("Parameter {0} is not configured - try setting it on the command line (-h for help)".format(attr))
AttributeError: Parameter hive_offset is not configured - try setting it on the command line (-h for help)

[kevthehermit]

Will have a quick look now but its half one in the AM :) So probably fix it tomorrow

[kevthehermit]

Found the issue. Looks like some plugins like to have HIVE_OFFSET and others like hive_offset set as a config param.

Will push a fix shortly.

[kevthehermit]

OK should be fixed in the latest commit. Let me know if you run in to any more issues with it

[Beercow]

Hivescan is returning this error now. Haven't tried Hive list.

ERROR Internal Server Error: /ajaxhandler/hivedetails/
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 149, in get_response
response = self.process_exception_by_middleware(e, request)
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 147, in get_response
response = wrapped_callback(request, _callback_args, *_callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(_args, *_kwargs)
File "/opt/VolUtility/web/views.py", line 922, in ajax_handler
hive_details = vol_int.run_plugin('hivedump', hive_offset=hive_offset)
File "/opt/VolUtility/web/vol_interface.py", line 271, in run_plugin
output_data = self.get_json(command)
File "/opt/VolUtility/web/vol_interface.py", line 179, in get_json
plugin.render_json(strio, plugin.calculate())
File "/usr/lib/python2.7/dist-packages/volatility/plugins/registry/printkey.py", line 209, in calculate
h = hivemod.HiveAddressSpace(addr_space, self._config, self._config.hive_offset)
File "/usr/lib/python2.7/dist-packages/volatility/win32/hive.py", line 51, in init
self.hive = obj.Object("_HHIVE", hive_addr, base)
File "/usr/lib/python2.7/dist-packages/volatility/obj.py", line 171, in Object
offset = int(offset)
ValueError: invalid literal for int() with base 10: '0xe2939d0'
ERROR : django.request : Internal Server Error: /ajaxhandler/hivedetails/
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 149, in get_response
response = self.process_exception_by_middleware(e, request)
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 147, in get_response
response = wrapped_callback(request, _callback_args, *_callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(_args, *_kwargs)
File "/opt/VolUtility/web/views.py", line 922, in ajax_handler
hive_details = vol_int.run_plugin('hivedump', hive_offset=hive_offset)
File "/opt/VolUtility/web/vol_interface.py", line 271, in run_plugin
output_data = self.get_json(command)
File "/opt/VolUtility/web/vol_interface.py", line 179, in get_json
plugin.render_json(strio, plugin.calculate())
File "/usr/lib/python2.7/dist-packages/volatility/plugins/registry/printkey.py", line 209, in calculate
h = hivemod.HiveAddressSpace(addr_space, self._config, self._config.hive_offset)
File "/usr/lib/python2.7/dist-packages/volatility/win32/hive.py", line 51, in init
self.hive = obj.Object("_HHIVE", hive_addr, base)
File "/usr/lib/python2.7/dist-packages/volatility/obj.py", line 171, in Object
offset = int(offset)
ValueError: invalid literal for int() with base 10: '0xe2939d0'

[Beercow]

Hivelist is fixed. Hivescan has a new error(previous post).

[kevthehermit]

OK, As i now have the Registry Parser extension which grabs all hives anyway. Have removed the hive details from here and instead tell you to use the dumpregistry plugin. Easier to maintain code in one function. Its on develop branch now will close when i release V1.0 later this weekend