class Rex::Registry::RegfBlock

Attributes

root_key_offset[RW]
timestamp[RW]

Public Class Methods

new(hive) click to toggle source
# File lib/rex/registry/regf.rb, line 8
def initialize(hive)

  regf_header = hive[0x00, 4]

  if regf_header !~ /regf/
    puts "Not a registry hive"
    return
  end

  @timestamp = hive[0x0C, 8].unpack('q').first
  @root_key_offset = 0x20

end