self.type, = struct.unpack("<l", blob[1].data)
if self.type == RegistryValue.TYPE_STRING:
self.data = clean_str(blob[2].data)
elif self.type == RegistryValue.TYPE_DWORD:
self.data = struct.unpack("<L", blob[2].data[:4])
else: # elif self.type == RegistryValue.TYPE_BINARY:
if blob[2].child is not None:
self.data = blob[2].child
else:
self.data = blob[2].data
def __str__(self):
return self.__repr__()
def __repr__(self):
if self.type == RegistryValue.TYPE_STRING:
return str("'" + self.data + "'")
elif self.type == RegistryValue.TYPE_DWORD:
return str(self.data)
elif self.type == RegistryValue.TYPE_BINARY:
if type(self.data) is str:
return str("".join(["\\x%s" % hex(ord(c))[2:] for c in self.data])) + "'"
else:
return repr(self.data)
if __name__ == "__main__":
handle = open("ClientRegistry.blob", "rb")
blob = Blob()
blob.read(handle)
registry = Registry()
registry.read(blob)
