internal ValueKey(byte[] bytes, string path, string key)
{
Signature = Encoding.ASCII.GetString(bytes, 0x04, 0x02);
if (Signature == "vk")
{
HivePath = path;
Key = key;
#region CellHeader
Size = BitConverter.ToInt32(bytes, 0x00);
if (Size >= 0)
{
Allocated = false;
}
else
{
Allocated = true;
}
#endregion CellHeader
NameLength = BitConverter.ToUInt16(bytes, 0x06);
#region DataLength
uint dataLengthRaw = BitConverter.ToUInt32(bytes, 0x08);
if (dataLengthRaw > 0x80000000)
{
DataLength = dataLengthRaw - 0x80000000;
ResidentData = true;
}
else
{
DataLength = dataLengthRaw;
ResidentData = false;
}
#endregion DataLength
DataOffset = BitConverter.ToUInt32(bytes, 0x0C) + RegistryHeader.HBINOFFSET;
DataType = (VALUE_KEY_DATA_TYPES)BitConverter.ToUInt32(bytes, 0x10);
Flags = (VALUE_KEY_FLAGS)BitConverter.ToUInt16(bytes, 0x14);
#region ValueName
if (NameLength == 0)
{
Name = "(Default)";
}
else
{
if (Flags == VALUE_KEY_FLAGS.NameIsAscii)
{
Name = Encoding.ASCII.GetString(bytes, 0x18, NameLength);
}
else
{
Name = Encoding.Unicode.GetString(bytes, 0x18, NameLength);
}
}
#endregion ValueName
}
else
{
throw new Exception("Cell is not a valid Value Key");
}
}
internal ValueKey(byte[] bytes, string path, string key)
{
Signature = Encoding.ASCII.GetString(bytes, 0x04, 0x02);
if (Signature == "vk")
{
HivePath = path;
Key = key;
#region CellHeader
Size = BitConverter.ToInt32(bytes, 0x00);
if (Size >= 0)
{
Allocated = false;
}
else
{
Allocated = true;
}
#endregion CellHeader
NameLength = BitConverter.ToUInt16(bytes, 0x06);
#region DataLength
uint dataLengthRaw = BitConverter.ToUInt32(bytes, 0x08);
if (dataLengthRaw > 0x80000000)
{
DataLength = dataLengthRaw - 0x80000000;
ResidentData = true;
}
else
{
DataLength = dataLengthRaw;
ResidentData = false;
}
#endregion DataLength
DataOffset = BitConverter.ToUInt32(bytes, 0x0C) + RegistryHeader.HBINOFFSET;
DataType = (VALUE_KEY_DATA_TYPES)BitConverter.ToUInt32(bytes, 0x10);
Flags = (VALUE_KEY_FLAGS)BitConverter.ToUInt16(bytes, 0x14);
#region ValueName
if (NameLength == 0)
{
Name = "(Default)";
}
else
{
if (Flags == VALUE_KEY_FLAGS.NameIsAscii)
{
Name = Encoding.ASCII.GetString(bytes, 0x18, NameLength);
}
else
{
Name = Encoding.Unicode.GetString(bytes, 0x18, NameLength);
}
}
#endregion ValueName
}
else
{
throw new Exception("Cell is not a valid Value Key");
}
}
