speeding up svcscan --verbose mode

[volatilityfoundation]

speeding up svcscan --verbose mode

[gleeda]

The patch is below and you can see that we are utilizing the given_root option so we can directly use the registry key objects instead of having to traverse for them again:

diff --git a/volatility/plugins/malware/svcscan.py b/volatility/plugins/malware/svcscan.py
index 1373758..2ec90ab 100644
--- a/volatility/plugins/malware/svcscan.py
+++ b/volatility/plugins/malware/svcscan.py
@@ -415,6 +415,15 @@ class SvcScan(common.AbstractWindowsCommand):
         if self._config.VERBOSE:
             regapi = registryapi.RegistryApi(self._config)
             ccs = regapi.reg_get_currentcontrolset()
+            key_name = "{0}\\services".format(ccs)
+            dlls = {}
+            for subkey in regapi.reg_get_all_subkeys(hive_name = "system", key = key_name):
+                for rootkey in regapi.reg_get_all_subkeys(hive_name = "system", key = "", given_root = subkey):
+                    if rootkey.Name == "Parameters":
+                        service_dll = regapi.reg_get_value(hive_name = "system", key = "", value = "ServiceDll", given_root = rootkey)
+                        if service_dll != None:
+                            dll = "{0}".format(service_dll)
+                            dlls[utils.remove_unprintable(str(subkey.Name))] = service_dll

         for rec in data:
             # This can't possibly look neat in a table with columns...
@@ -428,10 +437,7 @@ class SvcScan(common.AbstractWindowsCommand):
             outfd.write("Binary Path: {0}\n".format(rec.Binary))

             if self._config.VERBOSE:
-                val = regapi.reg_get_value(
-                                hive_name = "system", 
-                                key = "{0}\\services\\{1}\\Parameters".format(ccs, rec.ServiceName.dereference()), 
-                                value = "ServiceDll")
+                val = dlls.get("{0}".format(rec.ServiceName.dereference()), None)
                 if val is not None:
                     outfd.write("ServiceDll: {0}\n".format(val))

[iMHLv2]

sounds good to me