0x5bfa / regfparser

A paeser of the REGF (registry file format) files

Hi there 👋

I work on what I think I have to do every day to achieve my biggest goal in my life.
Right now, working on my second biggest goal irl, which must be done before that.

• 🏫 Not yet in university
• 💬 Speak Japanese
• 📝 C & C#
• 👨‍💻 Win32 (filesystem and console) & WinUI
• 👯 Working on Files app
• 🌱 Learning Windows low-level Win32 APIs for file system and shell
• 🔭 Want to learn kernel debugging and UEFI development

regfparser's Issues

Memory overwrite caused by using global memory

Unexpected memory changes caused by using global memory change global memory to heap memory.

Actual behavior

Cell:(Abs:0x2B98)[A8][FF][FF][FF][6E][6B]
    Size:                              0x58
    Signeture:                         nk
    Flags:                             0x20
    Time stamp:                        2021/09/12 08:56
    Access bits:                       0x2
    Parent offset:                     0x3D8
    Number of subkeys:                 0x0
    Number of volatile subkeys:        0x0
    Subkeys list offset:               0xFFFFFFFF
    Number of key values:              0x1
    Key values list offset:            0x19B8
    Key security offset:               0x178
    Class name offset:                 0xFFFFFFFF
    Largest subkey name length:        0x0
    Largest subkey class name length:  0x0
    Largest value name length:         0xE
    Largest value data size:           0x1
    WorkVar:                           0x0
    Key name length:                   0x8
    Class name length:                 0x0
    Key name:                          46000010

ValueList:(Abs:0x29B8)[F8][FF][FF][FF]
    Size:                              0x8
    Offset #0:                         0x1998

Cell:(Abs:0x2998)[E0][FF][FF][FF][76][6B]
    Size:                              0x20
    Signeture:                         vk
    Value name size:                   0x7
    Data size:                         0x80000001
    Data offset:                       0x1
    Data type:                         0x3
    Flags:                             0x1
    Key name:                          Element
    Data:                              0x1

ValueList:(Abs:0x29B8)[F8][FF][FF][FF]
    Size:                              0x8
    Offset #0:                         0x1998

Cell:(Abs:0x2998)[E0][FF][FF][FF][76][6B]
    Size:                              0x20
    Signeture:                         vk
    Value name size:                   0x7
    Data size:                         0x80000001
    Data offset:                       0x1
    Data type:                         0x3
    Flags:                             0x1
    Key name:                          Element
    Data:                              0x1

What happened

When the key node structure changed by the child key returns to the parent key, the unset is changed and the same value is referenced.

How to fix it to behave as expected

Change to a local variable and allocate heap memory. Since memory usage will increase more than before, we will organize variables.