Changes for missing separator in HKEY_USERS paths #180 (#188)

log2timeline · Dec 7, 2021 · cd432ae · cd432ae
1 parent b86ecb7
commit cd432ae
Show file tree

Hide file tree

Showing 3 changed files with 245 additions and 186 deletions.
diff --git a/dfwinreg/registry.py b/dfwinreg/registry.py
@@ -397,19 +397,21 @@ def _GetUsersVirtualKey(self, key_path_suffix):
 
         # HKEY_USERS\%SID%_CLASSES maps to UsrClass.dat
         if user_key_name.endswith('_CLASSES'):
-          profile_path = '\\'.join([
+          profile_path = definitions.KEY_PATH_SEPARATOR.join([
               profile_path, 'AppData', 'Local', 'Microsoft', 'Windows',
               'UsrClass.dat'])
         else:
-          profile_path = '\\'.join([profile_path, 'NTUSER.DAT'])
+          profile_path = definitions.KEY_PATH_SEPARATOR.join([
+              profile_path, 'NTUSER.DAT'])
 
         registry_file = self._GetUserFileByPath(profile_path)
         if not registry_file:
           break
 
         key_path_prefix = definitions.KEY_PATH_SEPARATOR.join([
             'HKEY_USERS', user_key_name])
-        key_path = ''.join([key_path_prefix, key_path_suffix])
+        key_path = definitions.KEY_PATH_SEPARATOR.join([
+            key_path_prefix, key_path_suffix])
 
         registry_file.SetKeyPathPrefix(key_path_prefix)
         return registry_file.GetKeyByPath(key_path)