class Rex::Registry::RegfBlock
Attributes
root_key_offset[RW]
timestamp[RW]
Public Class Methods
new(hive)
click to toggle source
# File lib/rex/registry/regf.rb, line 8 def initialize(hive) regf_header = hive[0x00, 4] if regf_header !~ /regf/ puts "Not a registry hive" return end @timestamp = hive[0x0C, 8].unpack('q').first @root_key_offset = 0x20 end