rapid7/metasploit-framework — pull request #98 by brandonprry (2012-01-11 01:03:48+00:00)
Title: Offline registry reading library for rex (Rex::Registry)

I understand the unpack()'s (see regf, lfkey, nodekey, valuekey, and valuelist) are an issue, but I cannot for the life of me get them to work properly with any other unpack() combinations. Any thoughts or suggestions are *much* appreciated.

I would also like feedback on the reg.rb implementation. HD said to emulate reg.exe, but after some tinkering, I think that my way is a more usable (though inspired by the reg.exe syntax) way from a forensics/IG standpoint. Perhaps I am making the scope of reg.rb too wide by adding the specific IG commands to it, and these should be left for other registry-related module implementations? Thoughts are appreciated.

If you would like to parse the lib next to some documentation, I mainly followed this document while implementing:
http://files.volatileminds.net/winreg.txt