metasploit-framework/lib/rex/registry/regf.rb

# -*- coding: binary -*-
module Rex
module Registry

class RegfBlock

  attr_accessor :timestamp, :root_key_offset

  def initialize(hive)

    regf_header = hive[0x00, 4]

    if regf_header !~ /regf/
      puts "Not a registry hive"
      return
    end

    @timestamp = hive[0x0C, 8].unpack('q').first
    @root_key_offset = 0x20

  end
end

end
end