public static NamedKey GetRootKey(string path)
        {
            byte[] bytes = GetHiveBytes(path);

            RegistryHeader header = new RegistryHeader(Util.GetSubArray(bytes, 0x00, 0x200));
            int offset = (int)header.RootKeyOffset + RegistryHeader.HBINOFFSET;
            int size = Math.Abs(BitConverter.ToInt32(bytes, offset));

            return new NamedKey(Util.GetSubArray(bytes, (uint)offset, (uint)size), path, "");
        }
        internal static NamedKey GetRootKey(byte[] bytes, string path)
        {
            #region RegistryHeader

            RegistryHeader header = new RegistryHeader(Util.GetSubArray(bytes, 0x00, 0x200));

            #endregion RegistryHeader

            int offset = (int)header.RootKeyOffset + RegistryHeader.HBINOFFSET;
            int size = Math.Abs(BitConverter.ToInt32(bytes, offset));

            return new NamedKey(Util.GetSubArray(bytes, (uint)offset, (uint)size), path, "");
        }
Esempio n. 3
0
        internal static NamedKey GetRootKey(byte[] bytes, string path)
        {
            #region RegistryHeader

            RegistryHeader header = new RegistryHeader(Helper.GetSubArray(bytes, 0x00, 0x200));

            #endregion RegistryHeader

            int offset = (int)header.RootKeyOffset + RegistryHeader.HBINOFFSET;
            int size   = Math.Abs(BitConverter.ToInt32(bytes, offset));

            return(new NamedKey(Helper.GetSubArray(bytes, offset, size), path, ""));
        }
Esempio n. 4
0
        public static HiveBinHeader[] GetInstances(string path)
        {
            FileRecord record = FileRecord.Get(path, true);
            byte[] bytes = record.GetContent();

            // Registry Header
            RegistryHeader header = new RegistryHeader(NativeMethods.GetSubArray(bytes, 0x00, 0x200));

            // Hive Bin Headers
            HiveBinHeader[] headerArray = new HiveBinHeader[header.HiveBinsDataSize / 0x1000];
            byte[] hbinHeaderBytes = new byte[0x20];
            uint i = 0x1000;
            while (i < header.HiveBinsDataSize + 0x1000)
            {
                HiveBinHeader hbinHeader = new HiveBinHeader(NativeMethods.GetSubArray(bytes, i, 0x20));
                headerArray[((i / 0x1000) - 1)] = hbinHeader;
                i += hbinHeader.hBinSize;
            }

            return headerArray;
        }
Esempio n. 5
0
        public static HiveBinHeader[] GetInstances(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            byte[] bytes = record.GetContent();

            // Registry Header
            RegistryHeader header = new RegistryHeader(NativeMethods.GetSubArray(bytes, 0x00, 0x200));

            // Hive Bin Headers
            HiveBinHeader[] headerArray     = new HiveBinHeader[header.HiveBinsDataSize / 0x1000];
            byte[]          hbinHeaderBytes = new byte[0x20];
            uint            i = 0x1000;

            while (i < header.HiveBinsDataSize + 0x1000)
            {
                HiveBinHeader hbinHeader = new HiveBinHeader(NativeMethods.GetSubArray(bytes, i, 0x20));
                headerArray[((i / 0x1000) - 1)] = hbinHeader;
                i += hbinHeader.hBinSize;
            }

            return(headerArray);
        }
Esempio n. 6
0
 public static RegistryHeader Get(string path)
 {
     return(new RegistryHeader(RegistryHeader.GetBytes(path)));
 }