diff --git a/src/windows-emulator/registry/hive_parser.hpp b/src/windows-emulator/registry/hive_parser.hpp index 3a2e0327..50cada54 100644 --- a/src/windows-emulator/registry/hive_parser.hpp +++ b/src/windows-emulator/registry/hive_parser.hpp @@ -10,13 +10,18 @@ // Based on this implementation: https://github.com/reahly/windows-hive-parser +struct offset_entry_t +{ + long offset; + long hash; +}; + struct offsets_t { long block_size; char block_type[2]; short count; - long first; - long hash; + offset_entry_t entries[0]; }; struct key_block_t @@ -86,7 +91,7 @@ public: std::vector out; for (auto i = 0; i < key_block->subkey_count; i++) { - const auto subkey = reinterpret_cast((&item->first)[i * 2] + this->main_root); + const auto subkey = reinterpret_cast(item->entries[i].offset + this->main_root); if (!subkey) continue; @@ -168,7 +173,7 @@ class hive_parser for (auto i = 0; i < item->count; i++) { - const auto subkey = reinterpret_cast((&item->first)[i * 2] + main_root); + const auto subkey = reinterpret_cast(item->entries[i].offset + main_root); if (!subkey) continue;