2012-06-29 05:18:28 +00:00
|
|
|
# -*- coding: binary -*-
|
2012-01-11 00:45:24 +00:00
|
|
|
require_relative "valuekey"
|
|
|
|
|
|
|
|
module Rex
|
|
|
|
module Registry
|
|
|
|
|
|
|
|
class ValueList
|
2012-05-24 23:10:26 +00:00
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
attr_accessor :values
|
2012-01-11 00:45:24 +00:00
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
def initialize(hive, offset, number_of_values)
|
|
|
|
offset = offset + 4
|
|
|
|
inner_offset = 0
|
2012-01-11 00:45:24 +00:00
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
@values = []
|
2012-01-11 00:45:24 +00:00
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
1.upto(number_of_values) do |v|
|
|
|
|
valuekey_offset = hive[offset + inner_offset, 4]
|
|
|
|
next if !valuekey_offset
|
2012-01-16 23:54:33 +00:00
|
|
|
|
2014-06-30 07:48:18 +00:00
|
|
|
valuekey_offset = valuekey_offset.unpack('V').first
|
2013-08-30 21:28:33 +00:00
|
|
|
@values << ValueKey.new(hive, valuekey_offset + 0x1000)
|
|
|
|
inner_offset = inner_offset + 4
|
|
|
|
end
|
|
|
|
end
|
2012-01-11 00:45:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
end
|
|
|
|
end
|