小编use*_*193的帖子

我关注" https://www.mandiant.com/blog/parsing-registry-hives-python/ ".

在代码下面运行:

f = open("SAMPLE1.DAT")
buf = f.read()
regf = RegistryParse.REGFBlock(buf, 0, false) 

for HBIN in regf.hbins():
    for cell in HBIN.cells():
        if cell.is_free():
            print "Unallocated cell at offset 0x%x" % (cell.offset())

我收到一个错误:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
NameError: name 'false' is not defined

原因是什么？

现在,它来到:

Traceback (most recent call last):
  File "mig.py", line 11, in <module>
    regf = RegistryParse.REGFBlock(buf, 0, False) 
  File "/usr/local/lib/python2.7/dist-packages/Registry/RegistryParse.py", line 236, in         __init__
    raise ParseException("Invalid REGF ID")
Registry.RegistryParse.ParseException: …