<分区>
我正在关注“https://www.mandiant.com/blog/parsing-registry-hives-python/”。
在运行以下代码时:
f = open("SAMPLE1.DAT")
buf = f.read()
regf = RegistryParse.REGFBlock(buf, 0, false)
for HBIN in regf.hbins():
for cell in HBIN.cells():
if cell.is_free():
print "Unallocated cell at offset 0x%x" % (cell.offset())
我得到一个错误:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
NameError: name 'false' is not defined
可能是什么原因？
现在，它变成了:
Traceback (most recent call last):
File "mig.py", line 11, in <module>
regf = RegistryParse.REGFBlock(buf, 0, False)
File "/usr/local/lib/python2.7/dist-packages/Registry/RegistryParse.py", line 236, in __init__
raise ParseException("Invalid REGF ID")
Registry.RegistryParse.ParseException: Registry Parse Exception(Invalid REGF ID)