예제 #1
0
        public static HiveBinHeader[] GetInstances(string path)
        {
            FileRecord record = FileRecord.Get(path, true);
            byte[] bytes = record.GetContent();

            // Registry Header
            RegistryHeader header = new RegistryHeader(NativeMethods.GetSubArray(bytes, 0x00, 0x200));

            // Hive Bin Headers
            HiveBinHeader[] headerArray = new HiveBinHeader[header.HiveBinsDataSize / 0x1000];
            byte[] hbinHeaderBytes = new byte[0x20];
            uint i = 0x1000;
            while (i < header.HiveBinsDataSize + 0x1000)
            {
                HiveBinHeader hbinHeader = new HiveBinHeader(NativeMethods.GetSubArray(bytes, i, 0x20));
                headerArray[((i / 0x1000) - 1)] = hbinHeader;
                i += hbinHeader.hBinSize;
            }

            return headerArray;
        }
예제 #2
0
        public static HiveBinHeader[] GetInstances(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            byte[] bytes = record.GetContent();

            // Registry Header
            RegistryHeader header = new RegistryHeader(NativeMethods.GetSubArray(bytes, 0x00, 0x200));

            // Hive Bin Headers
            HiveBinHeader[] headerArray     = new HiveBinHeader[header.HiveBinsDataSize / 0x1000];
            byte[]          hbinHeaderBytes = new byte[0x20];
            uint            i = 0x1000;

            while (i < header.HiveBinsDataSize + 0x1000)
            {
                HiveBinHeader hbinHeader = new HiveBinHeader(NativeMethods.GetSubArray(bytes, i, 0x20));
                headerArray[((i / 0x1000) - 1)] = hbinHeader;
                i += hbinHeader.hBinSize;
            }

            return(headerArray);
        }