Does not correctly parse Win8 FILETIME value types about python-registry HOT 5 CLOSED

Potentially relevant links:

• https://code.google.com/p/hotoloti/source/browse/zusb.pl
• http://doxygen.reactos.org/d0/dba/devpropdef_8h_source.html
• http://msdn.microsoft.com/en-us/library/windows/hardware/dn315030(v=vs.85).aspx

from python-registry.

Interesting to note there are many other "new" value types:

testing/issue31 - [master●] » python test.py SYSTEM | sort | uniq -c | sort -nr
  36051 RegSZ
  14609 RegDWord
   8343 RegBin
   3010 Unknown type: 0xffff0012
   2125 RegExpandSZ
   2025 RegMultiSZ
   1260 RegQWord
   1173 Unknown type: 0xffff0007
   1122 Unknown type: 0xffff0011
   1022 Unknown type: 0xffff0010
    690 RegNone
    508 Unknown type: 0xffff2012
    225 Unknown type: 0xffff1003
    139 Unknown type: 0x20001
    136 Unknown type: 0xffff000d
     99 Unknown type: 0x20004
     72 Unknown type: 0xffff0019
     63 Unknown type: 0xffff0009
     45 Unknown type: 0xffff0013
     36 RegResourceRequirementsList
     31 Unknown type: 0xffff0005
     27 RegResourceList
     18 Unknown type: 0x40007
     17 Unknown type: 0x20003
     10 Unknown type: 0xffff0006
      9 Unknown type: 0xffff0003
      4 Unknown type: 0xffff000f
      4 Unknown type: 0x200000
      2 Unknown type: 0x100000
      1 Unknown type: 0xffff100d
      1 Unknown type: 0xffff0017

Perhaps the upper two bytes are used for something else, now. Lower two bytes may correspond to the DEVPROP fields described by ReactOS.

Regedit doesn't yet understand these value types.

from python-registry.

Looking on the MSDN page below shows that you can work out the DEV_PROP_TYPE by using a bitwise "AND" and the "DEVPROP_MASK_TYPE", which is 0x00000FFF. So my data type value was 0xFFFF0010 and after performing the bitwise "AND" results in 10, which is data type DEVPROP_TYPE_FILETIME, which is the data type I would expect in the data offset:

http://msdn.microsoft.com/en-us/library/windows/hardware/ff543550(v=vs.85).aspx

from python-registry.

The differences in the offsets were a red-herring, further debugging revealed that the parsing needed is similar to that of the type BIN, with further processing to create the DateTime object. I have created a PULL request which adds a RegFileTime type and parsing capability

from python-registry.

Closed in 634fd42

from python-registry.