class Rex::Registry::ValueKey

Attributes

data_offset[RW]
full_path[RW]
length_of_data[RW]
name[RW]
name_length[RW]
readable_value_type[RW]
value[RW]
value_type[RW]

Public Class Methods

new(hive, offset) click to toggle source
# File lib/rex/registry/valuekey.rb, line 9
def initialize(hive, offset)
  offset = offset + 4

  vk_header = hive[offset, 2]

  if vk_header !~ /vk/
    puts "no vk at offset #{offset}"
    return
  end

  @name_length = hive[offset+0x02, 2].unpack('C').first
  @length_of_data = hive[offset+0x04, 4].unpack('V').first
  @data_offset = hive[offset+ 0x08, 4].unpack('V').first
  @value_type = hive[offset+0x0C, 4].unpack('C').first

  if @value_type == 1
    @readable_value_type = "Unicode character string"
  elsif @value_type == 2
    @readable_value_type = "Unicode string with %VAR% expanding"
  elsif @value_type == 3
    @readable_value_type = "Raw binary value"
  elsif @value_type == 4
    @readable_value_type = "Dword"
  elsif @value_type == 7
    @readable_value_type = "Multiple unicode strings separated with '\\x00'"
  end

  flag = hive[offset+0x10, 2].unpack('C').first

  if flag == 0
    @name = "Default"
  else
    @name = hive[offset+0x14, @name_length].to_s
  end

  @value = ValueKeyData.new(hive, @data_offset, @length_of_data, @value_type, offset)
end