Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def iter_cells(self, stream):
stream.seek(self.hbin_data_offset)
offset = stream.tell()
while offset < self.hbin_data_offset + self.header.size - HBIN_HEADER.sizeof():
hbin_cell_size = Int32sl.parse_stream(stream)
# If the cell size is positive, it means it is unallocated. We are not interested in those on a regular run
if hbin_cell_size >= 0:
continue
bytes_to_read = (hbin_cell_size * -1) - 4
cell_type = Bytes(2).parse_stream(stream)
# Yield the cell
yield Cell(cell_type=cell_type.decode(), offset=stream.tell(), size=bytes_to_read)
# Go to the next cell
offset += stream.tell() + bytes_to_read
if signature in [HASH_LEAF_SIGNATURE, FAST_LEAF_SIGNATURE]:
subkeys = LF_LH_SK_ELEMENT.parse_stream(stream)
elif signature == LEAF_INDEX_SIGNATURE:
subkeys = INDEX_LEAF.parse_stream(stream)
else:
raise RegistryParsingException(f'Expected a known signature, got: {signature} at offset {stream.tell()}')
for subkey in subkeys.elements:
stream.seek(REGF_HEADER_SIZE + subkey.key_node_offset)
# This cell should always be allocated, therefor we expect a negative size
cell_size = Int32sl.parse_stream(stream) * -1
# We read to this offset and skip 2 bytes, because that is the cell size we just read
nk_cell = Cell(cell_type='nk', offset=stream.tell() + 2, size=cell_size)
nk_record = NKRecord(cell=nk_cell, stream=stream)
yield nk_record