ntreg_lf_record can have id "lf" (old-style hashes) or "lh" (new-
style hashes).
---
hivex/hivex.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/hivex/hivex.c b/hivex/hivex.c
index ce3e14c..b106a10 100644
--- a/hivex/hivex.c
+++ b/hivex/hivex.c
@@ -195,7 +195,7 @@ struct ntreg_nk_record {
struct ntreg_lf_record {
int32_t seg_len;
- char id[2]; /* "lf" */
+ char id[2]; /* "lf"|"lh" */
uint16_t nr_keys; /* number of keys in this record */
struct {
uint32_t offset; /* offset of nk-record for this subkey */
--
1.6.5.2