metasploit-framework/lib/rex/registry/hive.rb

require_relative "regf"
require_relative "nodekey"

module Rex
module Registry

class Hive
	attr_accessor :root_key, :hive_regf

	def initialize(hivepath)
		
		hive_blob = open(hivepath, "rb") { |io| io.read }	
		@hive_regf = RegfBlock.new(hive_blob)
	
		@root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
	end

	def relative_query(path)

		if path == "" || path == "\\"
			return @root_key
		end

		current_child = nil
		paths = path.split("\\")

		return if !@root_key.lf_record
		
		@root_key.lf_record.children.each do |child|			
			next if child.name.downcase != paths[1].downcase

			current_child = child
		
			if paths.length == 2
				current_child.full_path = path
				return current_child
			end			
			
			2.upto(paths.length) do |i|

				if i == paths.length
					current_child.full_path = path
					return current_child
				else
					if current_child.lf_record && current_child.lf_record.children
						current_child.lf_record.children.each do |c|
							next if c.name.downcase != paths[i].downcase
							
							current_child = c
							
							break
						end
					end
				end
		
			end
		end

		return if !current_child

		current_child.full_path = path
		return current_child
	end

	def value_query(path)
		if path == "" || path == "\\"
			return nil
		end
	
		paths = path.split("\\")
		
		return if !@root_key.lf_record
		
		@root_key.lf_record.children.each do |root_child|
			next if root_child.name.downcase != paths[1].downcase

			current_child = root_child

			if paths.length == 2
				return nil
			end

			2.upto(paths.length - 1) do |i|
			        next if !current_child.lf_record
	
		                current_child.lf_record.children.each do |c|
                                	next if c.name != paths[i]
                                        current_child = c
                                        
                                        break
                                end
                        end

			if !current_child.value_list || current_child.value_list.values.length == 0
				return nil
			end

			current_child.value_list.values.each do |value|
				next if value.name.downcase != paths[paths.length - 1].downcase
				
				value.full_path = path
				return value
			end
		end
	end

end

end
end