RegistryとFile format(1)

レジストリのバイナリ構造について確認します。レジストリファイルの構造については、「Windows registry file format specification」の資料を参考にします。

サンプルのレジストリファイルは Windows 10 のNTUSER.DAT を利用します。

f:id:hideakii:20171126081916p:plain

Base Block

72 65 67 66 Signature regf
0C 01 00 00 Primary sequence number
0C 01 00 00 Secondary sequence number
00 00 00 00 00 00 00 00 Last written timestamp
01 00 00 00 Major version
05 00 00 00 Minor version
00 00 00 00 File type ⇒ 0 means primary file
01 00 00 00 File format ⇒ 1 means direct memory load
20 00 00 00 Root cell offset ⇒ 32
00 50 0E 00 Hive bins data size ⇒ 937,984
01 00 00 00 Clustering factor
3F 00 5C 00 43 00 3A 00 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 66 00 6F 00 72 00 65 00 6E 00 73 00 69 00 63 00 73 00 5C 00 6E 00 74 00 75 00 73 00 65 00 72 00 2E 00 64 00 61 00 74 00 00 00 File Name
Offset 112
74 A1 A6 47 14 A5 E7 11 A9 4E EC 0D 9A 05 C8 60 RmId
74 A1 A6 47 14 A5 E7 11 A9 4E EC 0D 9A 05 C8 60 LogId
00 00 00 00 Flags
75 A1 A6 47 14 A5 E7 11 A9 4E EC 0D 9A 05 C8 60 TmId
72 6D 74 6D GUID signature ⇒ rmtm
22 CD DD 2A 10 64 D3 01 Last reorganized timestamp ⇒ 11/23/2017 4:04:32 AM
4F665267010000000000000000000000 ⇒ ???

Hive bin

f:id:hideakii:20171126084958p:plain

68 62 69 6E Signature hbin
00 00 00 00 Offset
00 10 00 00 Size ⇒ 4096
00 00 00 00 00 00 00 00 ⇒ Reserved
00 00 00 00 00 00 00 00 ⇒ Timestamp
00 00 00 00 Spare (or MemAlloc)

Cell

A8 FF FF FF Size ⇒ -88 (negative if a cell is allocated）
6E 6B nk ⇒ Key node (nk) ⇒ Registry key node
2C 00 Flags
01 21 E3 2A 10 64 D3 01 Last written timestamp（UTC) ⇒ 11/23/2017 4:04:32 AM
02 00 00 00 Access bits
98 07 00 00 Parent
09 00 00 00 Number of subkeys ⇒ 9
01 00 00 00 Number if volatile subkeys ⇒ 1
60 0A 01 00 Subkey list offset ⇒ 68,192
68 02 00 80 Volatile subkey list offset
00 00 00 00 Number of key values
FF FF FF FF Key values list offset
50 65 00 00 Key security offset
FF FF FF FF Class name offset
2A 00 00 00 Largest subkey name length
00 00 00 00 Largest subkey class name length
00 00 00 00 Largest value name length
00 00 00 00 Largest value data size
00 00 00 00 WorkVar
04 00 Key name length
00 00 Class name length
52 4F 4F 54 00 00 00 00 ⇒ ROOT