class Rex::Registry::Hive

Attributes

hive_name[RW]
hive_regf[RW]
root_key[RW]

Public Class Methods

new(hivepath) click to toggle source
# File lib/rex/registry/hive.rb, line 10
def initialize(hivepath)

  hive_blob = open(hivepath, "rb") { |io| io.read }

  @hive_regf = RegfBlock.new(hive_blob)
  return nil if !@hive_regf.root_key_offset

  @root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
  return nil if !@root_key.lf_record

  keys = []
  root_key.lf_record.children.each do |key|
    keys << key.name
  end

  if keys.include? "LastKnownGoodRecovery"
    @hive_name = "SYSTEM"
  elsif keys.include? "Microsoft"
    @hive_name = "SOFTWARE"
  elsif keys.include? "Environment"
    @hive_name = "NTUSER.DAT"
  elsif keys.include? "SAM"
    @hive_name = "SAM"
  elsif keys.include? "Policy"
    @hive_name = "SECURITY"
  else
    @hive_name = "UNKNOWN"
  end

end

Public Instance Methods

relative_query(path) click to toggle source
# File lib/rex/registry/hive.rb, line 41
def relative_query(path)

  if path == "" || path == "\\"
    return @root_key
  end

  current_child = nil
  paths = path.split("\\")

  return if !@root_key.lf_record

  @root_key.lf_record.children.each do |child|
    next if child.name.downcase != paths[1].downcase

    current_child = child

    if paths.length == 2
      current_child.full_path = path
      return current_child
    end

    2.upto(paths.length) do |i|

      if i == paths.length
        current_child.full_path = path
        return current_child
      else
        if current_child.lf_record && current_child.lf_record.children
          current_child.lf_record.children.each do |c|
            next if c.name.downcase != paths[i].downcase

            current_child = c

            break
          end
        end
      end
    end
  end

  return if !current_child

  current_child.full_path = path
  return current_child
  end
value_query(path) click to toggle source
# File lib/rex/registry/hive.rb, line 87
  def value_query(path)
    if path == "" || path == "\\"
    return nil
  end

  paths = path.split("\\")

  return if !@root_key.lf_record

  @root_key.lf_record.children.each do |root_child|
    next if root_child.name.downcase != paths[1].downcase

    current_child = root_child

    if paths.length == 2
      return nil
    end

    2.upto(paths.length - 1) do |i|
      next if !current_child.lf_record

      current_child.lf_record.children.each do |c|
        next if c.name != paths[i]
        current_child = c

        break
      end
    end

    if !current_child.value_list || current_child.value_list.values.length == 0
      return nil
    end

    current_child.value_list.values.each do |value|
      next if value.name.downcase != paths[paths.length - 1].downcase

      value.full_path = path
      return value
    end
  end
end