class Rex::Registry::LFBlock

Attributes

children[RW]
hash_records[RW]
number_of_keys[RW]

Public Class Methods

new(hive_blob, offset) click to toggle source
# File lib/rex/registry/lfkey.rb, line 10
def initialize(hive_blob, offset)
  offset = offset + 4
  lf_header = hive_blob[offset, 2]

  if lf_header !~ /lf/ && lf_header !~ /lh/
    return
  end

  @number_of_keys = hive_blob[offset + 0x02, 2].unpack('C').first

  @hash_records = []
  @children = []

  hash_offset = offset + 0x04

  1.upto(@number_of_keys) do |h|

    hash = LFHashRecord.new(hive_blob, hash_offset)

    @hash_records << hash

    hash_offset = hash_offset + 0x08

    @children << NodeKey.new(hive_blob, hash.nodekey_offset + 0x1000)
  end
end