internal ValueKey(byte[] bytes, string path, string key) { Signature = Encoding.ASCII.GetString(bytes, 0x04, 0x02); if (Signature == "vk") { HivePath = path; Key = key; #region CellHeader Size = BitConverter.ToInt32(bytes, 0x00); if (Size >= 0) { Allocated = false; } else { Allocated = true; } #endregion CellHeader NameLength = BitConverter.ToUInt16(bytes, 0x06); #region DataLength uint dataLengthRaw = BitConverter.ToUInt32(bytes, 0x08); if (dataLengthRaw > 0x80000000) { DataLength = dataLengthRaw - 0x80000000; ResidentData = true; } else { DataLength = dataLengthRaw; ResidentData = false; } #endregion DataLength DataOffset = BitConverter.ToUInt32(bytes, 0x0C) + RegistryHeader.HBINOFFSET; DataType = (VALUE_KEY_DATA_TYPES)BitConverter.ToUInt32(bytes, 0x10); Flags = (VALUE_KEY_FLAGS)BitConverter.ToUInt16(bytes, 0x14); #region ValueName if (NameLength == 0) { Name = "(Default)"; } else { if (Flags == VALUE_KEY_FLAGS.NameIsAscii) { Name = Encoding.ASCII.GetString(bytes, 0x18, NameLength); } else { Name = Encoding.Unicode.GetString(bytes, 0x18, NameLength); } } #endregion ValueName } else { throw new Exception("Cell is not a valid Value Key"); } }