class Rex::Registry::ValueKey
Attributes
data_offset[RW]
full_path[RW]
length_of_data[RW]
name[RW]
name_length[RW]
readable_value_type[RW]
value[RW]
value_type[RW]
Public Class Methods
new(hive, offset)
click to toggle source
# File lib/rex/registry/valuekey.rb, line 9 def initialize(hive, offset) offset = offset + 4 vk_header = hive[offset, 2] if vk_header !~ /vk/ puts "no vk at offset #{offset}" return end @name_length = hive[offset+0x02, 2].unpack('C').first @length_of_data = hive[offset+0x04, 4].unpack('V').first @data_offset = hive[offset+ 0x08, 4].unpack('V').first @value_type = hive[offset+0x0C, 4].unpack('C').first if @value_type == 1 @readable_value_type = "Unicode character string" elsif @value_type == 2 @readable_value_type = "Unicode string with %VAR% expanding" elsif @value_type == 3 @readable_value_type = "Raw binary value" elsif @value_type == 4 @readable_value_type = "Dword" elsif @value_type == 7 @readable_value_type = "Multiple unicode strings separated with '\\x00'" end flag = hive[offset+0x10, 2].unpack('C').first if flag == 0 @name = "Default" else @name = hive[offset+0x14, @name_length].to_s end @value = ValueKeyData.new(hive, @data_offset, @length_of_data, @value_type, offset) end