-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathValueKey.cs
96 lines (67 loc) · 2.49 KB
/
ValueKey.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
using System;
using System.IO;
using System.Collections.Generic;
namespace ntregsharp
{
public class ValueKey
{
public ValueKey (BinaryReader hive)
{
this.AbsoluteOffset = hive.BaseStream.Position;
byte[] buf = hive.ReadBytes (2);
if (buf [0] != 0x76 && buf [1] != 0x6b)
throw new NotSupportedException ("Bad vk header");
buf = hive.ReadBytes (2);
this.NameLength = BitConverter.ToInt16 (buf, 0);
this.DataLength = BitConverter.ToInt32 (hive.ReadBytes (4), 0);
//dataoffset, unless data is stored here
byte[] databuf = hive.ReadBytes (4);
this.ValueType = hive.ReadInt32 ();
hive.BaseStream.Position += 4;
buf = hive.ReadBytes (this.NameLength);
this.Name = (this.NameLength == 0) ? "Default" : System.Text.Encoding.UTF8.GetString (buf);
if (this.DataLength < 5) {
this.DataOffset = this.AbsoluteOffset + 8;
this.Data = databuf;
} else {
hive.BaseStream.Position = 4096 + BitConverter.ToInt32 (databuf, 0) + 4;
this.DataOffset = hive.BaseStream.Position;
this.Data = hive.ReadBytes (this.DataLength);
if (this.ValueType == 1)
this.String = System.Text.Encoding.Unicode.GetString (this.Data);
}
}
public void EditName (FileStream hive, string newName)
{
byte[] name = System.Text.Encoding.UTF8.GetBytes (System.Text.Encoding.UTF8.GetString (System.Text.Encoding.ASCII.GetBytes (newName)));
if (name.Length > this.NameLength)
throw new Exception ("New name cannot be longer than old name currently.");
hive.Position = this.AbsoluteOffset + 20;
int k = this.NameLength - name.Length;
hive.Write (name, 0, name.Length);
for (int i = 0; i < k; i++)
hive.WriteByte (0x00);
}
public void EditData (FileStream hive, byte[] data, int valueType)
{
if (data.Length > this.DataLength)
throw new Exception ("New data cannot be longer than old data currently.");
byte[] bytes = BitConverter.GetBytes (valueType);
hive.Position = this.AbsoluteOffset + 12;
hive.Write (bytes, 0, bytes.Length);
hive.Position = this.DataOffset;
int k = this.DataLength - data.Length;
hive.Write (data, 0, data.Length);
for (int i = 0; i < k; i++)
hive.WriteByte (0x00);
}
public long AbsoluteOffset { get; set; }
public short NameLength { get; set; }
public int DataLength { get; set; }
public long DataOffset { get; set; }
public int ValueType { get; set; }
public string Name { get; set; }
public byte[] Data { get; set; }
public string String { get; set; }
}
}