Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 

README.md

ntreg-sharp

This library enables a .NET or Mono programmer to read, and to an extent write to, offline NT registry hives.

Write support is basically experimental, and has a few caveats:

  1. The new string or data must be less than or equal the size of the original string or data

  2. If the string or data is less than the original, null bytes are appended.

I call this lazy writing, because the real way to do this is to update the node and value key data lengths AND the data itself, which requires expanding or contracting the size of the original hive. This is a bit more complicated. For most of my purposes, this lazy-write method has worked well. For instance, NTLM hashes are all the same size. :)

About

Offline parsing of NT registry hives.

Resources

License

Packages

No packages published

Languages