Adds support for REG_MULTI_SZ vtype in custom module

plus3it · Aug 2, 2024 · f3ebed8 · f3ebed8
1 parent 9890433
commit f3ebed8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/_modules/win_lgpo_ash.py b/_modules/win_lgpo_ash.py
@@ -98,6 +98,8 @@ def __init__(self):
                 "REG_DWORD": "REG_DWORD",
                 "SZ": "REG_SZ",
                 "REG_SZ": "REG_SZ",
+                "MULTISZ": "REG_MULTI_SZ",
+                "REG_MULTI_SZ": "REG_MULTI_SZ",
             },
             "hives": {
                 "COMPUTER": "Machine",
@@ -512,6 +514,8 @@ def _buildKnownDataSearchString(
             this_element_value = struct.pack(b"Q", int(reg_data))
         elif reg_vtype == "REG_SZ":
             this_element_value = _encode_string(reg_data)
+        elif reg_vtype == "REG_MULTI_SZ":
+            this_element_value = _encode_string(reg_data)
         return b"".join(
             [
                 "[".encode("utf-16-le"),