Index: /trunk/doc/reglookup.1.docbook
===================================================================
--- /trunk/doc/reglookup.1.docbook	(revision 124)
+++ /trunk/doc/reglookup.1.docbook	(revision 125)
@@ -27,6 +27,5 @@
         print them out to stdout in a CSV-like format.  It has filtering
         options to narrow the focus of the output.  This tool is
-        designed to work with on Windows NT/2K/XP/2K3/Vista registries, 
-        though your mileage may vary.
+        designed to work with on Windows NT-based registries.
     </para>
   </refsect1>
@@ -108,7 +107,7 @@
         <listitem>
 	  <para>
-	    Adds four additional columns to output containing 
-	    information from key security descriptors.  The columns 
-	    are: owner, group, sacl, dacl.
+	    Adds five additional columns to output containing 
+	    information from key security descriptors and rarely used
+            fields.  The columns are: owner, group, sacl, dacl, class.
 	    (This feature's output has not been extensively tested.)
 	  </para>
Index: /trunk/include/regfi.h
===================================================================
--- /trunk/include/regfi.h	(revision 124)
+++ /trunk/include/regfi.h	(revision 125)
@@ -89,4 +89,10 @@
 
 /* Constants used for validation */
+/* XXX: Can we add clock resolution validation as well as range?  It has
+ *      been reported that Windows timestamps are never more than a
+ *      certain granularity (250ms?), which could be used to help
+ *      eliminate false positives.  Would need to validate this and
+ *      perhaps conservatively implement a check.
+ */
  /* Minimum time is Jan 1, 1990 00:00:00 */
 #define REGFI_MTIME_MIN_HIGH       0x01B41E6D
@@ -108,5 +114,5 @@
 #define NK_TYPE_NORMALKEY	   0x0020
 #define NK_TYPE_ROOTKEY		   0x002c
- /* TODO: Unknown type that shows up in Vista registries */
+ /* XXX: Unknown type that shows up in Vista registries */
 #define NK_TYPE_UNKNOWN1           0x1020
 
@@ -216,5 +222,4 @@
   
   /* header information */
-  /* XXX: should we be looking for types other than the root key type? */
   uint16 key_type;
   uint8  magic[REC_HDR_SIZE];
@@ -224,6 +229,6 @@
   char* classname;
   char* keyname;
-  uint32 parent_off;	/* back pointer in registry hive */
-  uint32 classname_off;	
+  uint32 parent_off;	            /* pointer to parent key */
+  uint32 classname_off;
   
   /* max lengths */
Index: /trunk/lib/regfi.c
===================================================================
--- /trunk/lib/regfi.c	(revision 124)
+++ /trunk/lib/regfi.c	(revision 125)
@@ -1583,5 +1583,4 @@
   ret_val->values_off = IVAL(nk_header, 0x28);
   ret_val->sk_off = IVAL(nk_header, 0x2C);
-  /* XXX: currently we do nothing with class names.  Need to investigate. */
   ret_val->classname_off = IVAL(nk_header, 0x30);
 
@@ -1594,4 +1593,5 @@
   ret_val->name_length = SVAL(nk_header, 0x48);
   ret_val->classname_length = SVAL(nk_header, 0x4A);
+
 
   if(ret_val->name_length + REGFI_NK_MIN_LENGTH > ret_val->cell_size)
@@ -1634,4 +1634,36 @@
   }
   ret_val->keyname[ret_val->name_length] = '\0';
+
+
+  /***/
+  
+  if(ret_val->classname_length > 0 
+     && ret_val->classname_off != REGF_OFFSET_NONE 
+     && ret_val->classname_off == (ret_val->classname_off & 0xFFFFFFF8))
+  {
+    ret_val->classname = (char*)zalloc(ret_val->classname_length+1);
+    if(ret_val->classname != NULL)
+    {
+      if(!regfi_parse_cell(file->fd, ret_val->classname_off+REGF_BLOCKSIZE, 
+			   (uint8*)ret_val->classname, ret_val->classname_length,
+			   &cell_length, &unalloc) 
+	 || (cell_length < ret_val->classname_length)
+	 || (strict && unalloc))
+      {
+	/* Being careful not to reject the whole key here even when
+	 * strict and things are obviously wrong, since it appears
+	 * they're commonly obviously wrong. 
+	 */
+	free(ret_val->classname);
+	ret_val->classname = NULL;
+	return ret_val;
+      }
+
+      ret_val->classname[ret_val->classname_length] = '\0';
+      /*printf("==> cell_length=%d, classname_length=%d, max_bytes_subkeyclassname=%d\n", cell_length, ret_val->classname_length, ret_val->max_bytes_subkeyclassname);*/
+    }
+  }
+  /***/
+
 
   return ret_val;
Index: /trunk/src/reglookup.c
===================================================================
--- /trunk/src/reglookup.c	(revision 124)
+++ /trunk/src/reglookup.c	(revision 125)
@@ -47,5 +47,5 @@
 
 /* XXX: A hack to share some functions with reglookup-recover.c.
- *      Should move these into a properly library at some point.
+ *      Should move these into a proper library at some point.
  */
 #include "common.c"
@@ -295,4 +295,5 @@
   char* sacl = NULL;
   char* dacl = NULL;
+  char* quoted_classname;
   char mtime[20];
   time_t tmp_time[1];
@@ -320,6 +321,11 @@
       dacl = empty_str;
 
-    printf("%s,KEY,,%s,%s,%s,%s,%s\n", full_path, mtime, 
-	   owner, group, sacl, dacl);
+    if(k->classname != NULL)
+      quoted_classname = quote_string(k->classname, key_special_chars);
+    else
+      quoted_classname = empty_str;
+
+    printf("%s,KEY,,%s,%s,%s,%s,%s,%s\n", full_path, mtime, 
+	   owner, group, sacl, dacl, quoted_classname);
 
     if(owner != empty_str)
@@ -331,4 +337,6 @@
     if(dacl != empty_str)
       free(dacl);
+    if(quoted_classname != empty_str)
+      free(quoted_classname);
   }
   else
@@ -582,5 +590,5 @@
   {
     if(print_security)
-      printf("PATH,TYPE,VALUE,MTIME,OWNER,GROUP,SACL,DACL\n");
+      printf("PATH,TYPE,VALUE,MTIME,OWNER,GROUP,SACL,DACL,CLASS\n");
     else
       printf("PATH,TYPE,VALUE,MTIME\n");
