Index: trunk/doc/Makefile
===================================================================
--- trunk/doc/Makefile	(revision 25)
+++ trunk/doc/Makefile	(revision 26)
@@ -3,4 +3,10 @@
 default:
 	mkdir -p $(BUILD_DOC)/man/man1
+	cp man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1/reglookup.1.gz
+
+install:
+	cp -r $(BUILD_DOC)/* $(DOC_PREFIX)
+	ln -sf $(DOC_PREFIX)/man/man1/*  $(MAN_PREFIX)/man1
+
 
 #XXX: Used during release only
@@ -8,7 +14,2 @@
 	txt2tags --mask-email -t man -o man/man1/reglookup.1 reglookup.txt
 	cd man/man1 && gzip -9 reglookup.1
-
-build: generate default
-
-install:
-	ln -sf $(DOC_PREFIX)/man/man1/*  $(MAN_PREFIX)/man1
Index: trunk/doc/TODO
===================================================================
--- trunk/doc/TODO	(revision 25)
+++ 	(revision )
@@ -1,17 +1,0 @@
-$Id$
-
-If you are interested in contributing to this project, here's a few
-things you could look into:
-
- - Testing, testing, and more testing.  reglookup needs to be tested on 
-   NT/XP/2k3.  A regression test suite would be nice too.
-
- - Build system.  I do not wish to use automake/autoconf in this
-   project.  However, more intelligent use of make would be nice.
-   I don't know it that well.
-
- - Unicode support.  I have never internationalized any software
-   before.  This would be a big help for the SZ, EXPAND_SZ, and MULTI_SZ
-   data types.
-
- - Grep through the source for 'XXX', and you'll find more.
Index: trunk/doc/devel/TODO
===================================================================
--- trunk/doc/devel/TODO	(revision 26)
+++ trunk/doc/devel/TODO	(revision 26)
@@ -0,0 +1,17 @@
+$Id$
+
+If you are interested in contributing to this project, here's a few
+things you could look into:
+
+ - Testing, testing, and more testing.  reglookup needs to be tested on 
+   NT/XP/2k3.  A regression test suite would be nice too.
+
+ - Build system.  I do not wish to use automake/autoconf in this
+   project.  However, more intelligent use of make would be nice.
+   I don't know it that well.
+
+ - Unicode support.  I have never internationalized any software
+   before.  This would be a big help for the SZ, EXPAND_SZ, and MULTI_SZ
+   data types.
+
+ - Grep through the source for 'XXX', and you'll find more.
Index: trunk/doc/devel/references.txt
===================================================================
--- trunk/doc/devel/references.txt	(revision 26)
+++ trunk/doc/devel/references.txt	(revision 26)
@@ -0,0 +1,4 @@
+
+- Petter Nordahl-Hagen.  Windows NT registry file format description.
+  (The file 'winntreg.txt' included in this distribution is derived from this.)
+  http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt
Index: trunk/doc/devel/winntreg.txt
===================================================================
--- trunk/doc/devel/winntreg.txt	(revision 26)
+++ trunk/doc/devel/winntreg.txt	(revision 26)
@@ -0,0 +1,268 @@
+The windows NT registry has 2 different blocks, where one can occur many
+times...
+
+the "regf"-Block
+================
+ 
+"regf" is obviosly the abbreviation for "Registry file". "regf" is the
+signature of the header-block which is always 4kb in size, although only
+the first 64 bytes seem to be used and a checksum is calculated over
+the first 0x200 bytes only!
+
+Offset            Size      Contents
+0x00000000      D-Word      ID: ASCII-"regf" = 0x66676572
+0x00000004      D-Word      ???? //see struct REGF
+0x00000008      D-Word      ???? Always the same value as at 0x00000004
+0x0000000C      Q-Word      last modify date in WinNT date-format
+0x00000014      D-Word      1
+0x00000018      D-Word      3
+0x0000001C      D-Word      0
+0x00000020      D-Word      1
+0x00000024      D-Word      Offset of 1st key record
+0x00000028      D-Word      Size of the data-blocks (Filesize-4kb)
+0x0000002C      D-Word      1
+0x000001FC      D-Word      Sum of all D-Words from 0x00000000 to
+0x000001FB  //XOR of all words. Nigel
+
+I have analyzed more registry files (from multiple machines running
+NT 4.0 german version) and could not find an explanation for the values
+marked with ???? the rest of the first 4kb page is not important...
+
+the "hbin"-Block
+================
+I dont know what "hbin" stands for, but this block is always a multiple
+of 4kb in size.
+
+Inside these hbin-blocks the different records are placed. The memory-
+management looks like a C-compiler heap management to me...
+
+hbin-Header
+===========
+Offset      Size      Contents
+0x0000      D-Word      ID: ASCII-"hbin" = 0x6E696268
+0x0004      D-Word      Offset from the 1st hbin-Block
+0x0008      D-Word      Offset to the next hbin-Block
+0x001C      D-Word      Block-size
+
+The values in 0x0008 and 0x001C should be the same, so I dont know
+if they are correct or swapped...
+
+From offset 0x0020 inside a hbin-block data is stored with the following
+format:
+
+Offset      Size      Contents
+0x0000      D-Word      Data-block size    //this size must be a
+multiple of 8. Nigel
+0x0004      ????      Data
+ 
+If the size field is negative (bit 31 set), the corresponding block
+is free and has a size of -blocksize!
+
+That does not seem to be true. All block lengths seem to be negative! 
+(Richard Sharpe) 
+
+The data is stored as one record per block. Block size is a multiple
+of 4 and the last block reaches the next hbin-block, leaving no room.
+
+(That also seems incorrect, in that the block size if a multiple of 8.
+That is, the block, including the 4 byte header, is always a multiple of
+8 bytes. Richard Sharpe.)
+
+Records in the hbin-blocks
+==========================
+
+nk-Record
+
+      The nk-record can be treated as a kombination of tree-record and
+      key-record of the win 95 registry.
+
+lf-Record
+
+      The lf-record is the counterpart to the RGKN-record (the
+      hash-function)
+
+vk-Record
+
+      The vk-record consists information to a single value.
+
+sk-Record
+
+      sk (? Security Key ?) is the ACL of the registry.
+
+Value-Lists
+
+      The value-lists contain information about which values are inside a
+      sub-key and dont have a header.
+
+Datas
+
+      The datas of the registry are (like the value-list) stored without a
+      header.
+
+All offset-values are relative to the first hbin-block and point to the
+block-size field of the record-entry. to get the file offset, you have to add
+the header size (4kb) and the size field (4 bytes)...
+
+the nk-Record
+=============
+Offset      Size      Contents
+0x0000      Word      ID: ASCII-"nk" = 0x6B6E
+0x0002      Word      for the root-key: 0x2C, otherwise 0x20  //key symbolic links 0x10. Nigel
+0x0004      Q-Word      write-date/time in windows nt notation
+0x0010      D-Word      Offset of Owner/Parent key
+0x0014      D-Word      number of sub-Keys
+0x001C      D-Word      Offset of the sub-key lf-Records
+0x0024      D-Word      number of values
+0x0028      D-Word      Offset of the Value-List
+0x002C      D-Word      Offset of the sk-Record
+
+0x0030      D-Word      Offset of the Class-Name //see NK structure for the use of these fields. Nigel
+0x0044      D-Word      Unused (data-trash)  //some kind of run time index. Does not appear to be important. Nigel
+0x0048      Word      name-length
+0x004A      Word      class-name length
+0x004C      ????      key-name
+
+the Value-List
+==============
+Offset      Size      Contents
+0x0000      D-Word      Offset 1st Value
+0x0004      D-Word      Offset 2nd Value
+0x????      D-Word      Offset nth Value
+
+To determine the number of values, you have to look at the owner-nk-record!
+
+Der vk-Record
+=============
+Offset      Size      Contents
+0x0000      Word      ID: ASCII-"vk" = 0x6B76
+0x0002      Word      name length
+0x0004      D-Word      length of the data   //if top bit is set when offset contains data. Nigel
+0x0008      D-Word      Offset of Data
+0x000C      D-Word      Type of value
+0x0010      Word      Flag
+0x0012      Word      Unused (data-trash)
+0x0014      ????      Name
+
+If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
+
+If the data-size is lower 5, the data-offset value is used to store the data itself!
+
+The data-types
+==============
+Wert      Beteutung
+0x0001      RegSZ:             character string (in UNICODE!)
+0x0002      ExpandSZ:   string with "%var%" expanding (UNICODE!)
+0x0003      RegBin:           raw-binary value
+0x0004      RegDWord:   Dword
+0x0007      RegMultiSZ:      multiple strings, seperated with 0
+                  (UNICODE!)
+
+The "lf"-record
+===============
+Offset      Size      Contents
+0x0000      Word      ID: ASCII-"lf" = 0x666C
+0x0002      Word      number of keys
+0x0004      ????      Hash-Records
+
+Hash-Record
+===========
+Offset      Size      Contents
+0x0000      D-Word      Offset of corresponding "nk"-Record
+0x0004      D-Word      ASCII: the first 4 characters of the key-name, padded with 0-s. Case sensitiv!
+
+Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the 
+key-name you have to change the hash-value too!
+
+//These hashrecords must be sorted low to high within the lf record. Nigel.
+
+The "sk"-block
+==============
+(due to the complexity of the SAM-info, not clear jet)
+(This is just a self-relative security descriptor in the data. R Sharpe.) 
+
+
+Offset      Size      Contents
+0x0000      Word      ID: ASCII-"sk" = 0x6B73
+0x0002      Word      Unused
+0x0004      D-Word      Offset of previous "sk"-Record
+0x0008      D-Word      Offset of next "sk"-Record
+0x000C      D-Word      usage-counter
+0x0010      D-Word      Size of "sk"-record in bytes
+????                                             //standard self
+relative security desciptor. Nigel
+????  ????      Security and auditing settings...
+????
+
+The usage counter counts the number of references to this
+"sk"-record. You can use one "sk"-record for the entire registry!
+
+Windows nt date/time format
+===========================
+The time-format is a 64-bit integer which is incremented every
+0,0000001 seconds by 1 (I dont know how accurate it really is!)
+It starts with 0 at the 1st of january 1601 0:00! All values are
+stored in GMT time! The time-zone is important to get the real
+time!
+
+Common values for win95 and win-nt
+==================================
+Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
+If a value has no name (length=0, flag(bit 0)=0), it is treated as the
+"Default" entry...
+If a value has no data (length=0), it is displayed as empty.
+
+simplyfied win-3.?? registry:
+=============================
+
++-----------+
+| next rec. |---+                      +----->+------------+
+| first sub |   |                      |      | Usage cnt. |
+| name      |   |  +-->+------------+  |      | length     |
+| value     |   |  |   | next rec.  |  |      | text       |------->+-------+
++-----------+   |  |   | name rec.  |--+      +------------+        | xxxxx |
+   +------------+  |   | value rec. |-------->+------------+        +-------+
+   v               |   +------------+         | Usage cnt. |
++-----------+      |                          | length     |
+| next rec. |      |                          | text       |------->+-------+
+| first sub |------+                          +------------+        | xxxxx |
+| name      |                                                       +-------+
+| value     |
++-----------+    
+
+Greatly simplyfied structure of the nt-registry:
+================================================
+   
++---------------------------------------------------------------+
+|                                                               |
+v                                                               |
++---------+     +---------->+-----------+  +----->+---------+   |
+| "nk"    |     |           | lf-rec.   |  |      | nk-rec. |   |
+| ID      |     |           | # of keys |  |      | parent  |---+
+| Date    |     |           | 1st key   |--+      | ....    |
+| parent  |     |           +-----------+         +---------+
+| suk-keys|-----+
+| values  |--------------------->+----------+
+| SK-rec. |---------------+      | 1. value |--> +----------+
+| class   |--+            |      +----------+    | vk-rec.  |
++---------+  |            |                      | ....     |
+             v            |                      | data     |--> +-------+
+      +------------+      |                      +----------+    | xxxxx |
+      | Class name |      |                                      +-------+
+      +------------+      |
+                          v
+          +---------+    +---------+
+   +----->| next sk |--->| Next sk |--+
+   |  +---| prev sk |<---| prev sk |  |
+   |  |   | ....    |    | ...     |  |
+   |  |   +---------+    +---------+  |
+   |  |                    ^          |
+   |  |                    |          |
+   |  +--------------------+          |
+   +----------------------------------+
+
+---------------------------------------------------------------------------
+
+Hope this helps....  (Although it was *fun* for me to uncover this things,
+                  it took me several sleepless nights ;)
+
+            B.D.
Index: trunk/doc/references.txt
===================================================================
--- trunk/doc/references.txt	(revision 25)
+++ 	(revision )
@@ -1,4 +1,0 @@
-
-- Petter Nordahl-Hagen.  Windows NT registry file format description.
-  (The file 'winntreg.txt' included in this distribution is derived from this.)
-  http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt
Index: trunk/doc/reglookup.1.t2t
===================================================================
--- trunk/doc/reglookup.1.t2t	(revision 26)
+++ trunk/doc/reglookup.1.t2t	(revision 26)
@@ -0,0 +1,89 @@
+reglookup
+
+
+=NAME=
+	reglookup - Windoze NT/2K/XP registry reader/lookup tool
+
+
+=SYNOPSIS=
+	reglookup [options] <REGISTRY_FILE>
+
+
+=DESCRIPTION=
+	reglookup is designed to read Windoze registry elements and
+	print them out to stdout.  It has several filtering options to
+	narrow the focus of the output.
+
+
+=OPTIONS=
+	-f<PREFIX_FILTER>	
+		Specify a path filter.  Only keys/values under this
+		registry path will be output.
+
+	-t<TYPE_FILTER>
+		Specify a type filter.  Only elements which match this
+		registry data type will be printed.  Acceptable values
+		are: SZ,EXPAND_SZ,BIN,DWORD,MULTI_SZ,KEY
+
+	-s	Print security descriptors as well as keys/values/data.
+		(This feature's output is not standardized, and probably
+		contains bugs.) 
+	
+	-v	Verbose output.
+
+
+	REGISTRY_FILE
+		Required argument.  Specifies the location of the
+		registry file to read.  Typically, these files will be
+		found on a Windoze partition under
+		%SystemRoot%/system32/config. 
+
+
+=EXAMPLES=
+	To read and print an entire registry:
+
+	**reglookup /mnt/win/c/WINNT/system32/config/system**
+
+	To limit the output to just those entries under the Services
+	key: 
+
+	**reglookup -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system**
+
+	To limit the output to all registry values of type BIN:
+
+	**reglookup -tBIN /mnt/win/c/WINNT/system32/config/system**
+	
+	And to limit the output to BIN values under the Services key:
+
+	**reglookup -tBIN -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system**
+
+
+=BUGS=
+	Path filtering is currently a slow hack.
+
+	The current incarnation of this program has only been tested on
+	Windoze 2000.
+
+	You'll notice that registry paths aren't all the same as the
+	ones the equivalents you see in Windoze.  Don't ask me why that
+	is.  I just work here.
+
+	This software should be considered unstable at this time.
+
+
+=CREDITS=
+	This program is based on editreg.c by Richard Sharpe.
+
+	It has since been modified by Timothy D. Morgan.
+
+	Please see source code for a full list of copyrights.
+
+
+=LICENSE=
+	Please see the file "LICENSE" included with this software
+	distribution.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License version 2 for more details.
Index: trunk/doc/reglookup.txt
===================================================================
--- trunk/doc/reglookup.txt	(revision 25)
+++ 	(revision )
@@ -1,89 +1,0 @@
-reglookup
-
-
-=NAME=
-	reglookup - Windoze NT/2K/XP registry reader/lookup tool
-
-
-=SYNOPSIS=
-	reglookup [options] <REGISTRY_FILE>
-
-
-=DESCRIPTION=
-	reglookup is designed to read Windoze registry elements and
-	print them out to stdout.  It has several filtering options to
-	narrow the focus of the output.
-
-
-=OPTIONS=
-	-f<PREFIX_FILTER>	
-		Specify a path filter.  Only keys/values under this
-		registry path will be output.
-
-	-t<TYPE_FILTER>
-		Specify a type filter.  Only elements which match this
-		registry data type will be printed.  Acceptable values
-		are: SZ,EXPAND_SZ,BIN,DWORD,MULTI_SZ,KEY
-
-	-s	Print security descriptors as well as keys/values/data.
-		(This feature's output is not standardized, and probably
-		contains bugs.) 
-	
-	-v	Verbose output.
-
-
-	REGISTRY_FILE
-		Required argument.  Specifies the location of the
-		registry file to read.  Typically, these files will be
-		found on a Windoze partition under
-		%SystemRoot%/system32/config. 
-
-
-=EXAMPLES=
-	To read and print an entire registry:
-
-	**reglookup /mnt/win/c/WINNT/system32/config/system**
-
-	To limit the output to just those entries under the Services
-	key: 
-
-	**reglookup -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system**
-
-	To limit the output to all registry values of type BIN:
-
-	**reglookup -tBIN /mnt/win/c/WINNT/system32/config/system**
-	
-	And to limit the output to BIN values under the Services key:
-
-	**reglookup -tBIN -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system**
-
-
-=BUGS=
-	Path filtering is currently a slow hack.
-
-	The current incarnation of this program has only been tested on
-	Windoze 2000.
-
-	You'll notice that registry paths aren't all the same as the
-	ones the equivalents you see in Windoze.  Don't ask me why that
-	is.  I just work here.
-
-	This software should be considered unstable at this time.
-
-
-=CREDITS=
-	This program is based on editreg.c by Richard Sharpe.
-
-	It has since been modified by Timothy D. Morgan.
-
-	Please see source code for a full list of copyrights.
-
-
-=LICENSE=
-	Please see the file "LICENSE" included with this software
-	distribution.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License version 2 for more details.
Index: trunk/doc/winntreg.txt
===================================================================
--- trunk/doc/winntreg.txt	(revision 25)
+++ 	(revision )
@@ -1,268 +1,0 @@
-The windows NT registry has 2 different blocks, where one can occur many
-times...
-
-the "regf"-Block
-================
- 
-"regf" is obviosly the abbreviation for "Registry file". "regf" is the
-signature of the header-block which is always 4kb in size, although only
-the first 64 bytes seem to be used and a checksum is calculated over
-the first 0x200 bytes only!
-
-Offset            Size      Contents
-0x00000000      D-Word      ID: ASCII-"regf" = 0x66676572
-0x00000004      D-Word      ???? //see struct REGF
-0x00000008      D-Word      ???? Always the same value as at 0x00000004
-0x0000000C      Q-Word      last modify date in WinNT date-format
-0x00000014      D-Word      1
-0x00000018      D-Word      3
-0x0000001C      D-Word      0
-0x00000020      D-Word      1
-0x00000024      D-Word      Offset of 1st key record
-0x00000028      D-Word      Size of the data-blocks (Filesize-4kb)
-0x0000002C      D-Word      1
-0x000001FC      D-Word      Sum of all D-Words from 0x00000000 to
-0x000001FB  //XOR of all words. Nigel
-
-I have analyzed more registry files (from multiple machines running
-NT 4.0 german version) and could not find an explanation for the values
-marked with ???? the rest of the first 4kb page is not important...
-
-the "hbin"-Block
-================
-I dont know what "hbin" stands for, but this block is always a multiple
-of 4kb in size.
-
-Inside these hbin-blocks the different records are placed. The memory-
-management looks like a C-compiler heap management to me...
-
-hbin-Header
-===========
-Offset      Size      Contents
-0x0000      D-Word      ID: ASCII-"hbin" = 0x6E696268
-0x0004      D-Word      Offset from the 1st hbin-Block
-0x0008      D-Word      Offset to the next hbin-Block
-0x001C      D-Word      Block-size
-
-The values in 0x0008 and 0x001C should be the same, so I dont know
-if they are correct or swapped...
-
-From offset 0x0020 inside a hbin-block data is stored with the following
-format:
-
-Offset      Size      Contents
-0x0000      D-Word      Data-block size    //this size must be a
-multiple of 8. Nigel
-0x0004      ????      Data
- 
-If the size field is negative (bit 31 set), the corresponding block
-is free and has a size of -blocksize!
-
-That does not seem to be true. All block lengths seem to be negative! 
-(Richard Sharpe) 
-
-The data is stored as one record per block. Block size is a multiple
-of 4 and the last block reaches the next hbin-block, leaving no room.
-
-(That also seems incorrect, in that the block size if a multiple of 8.
-That is, the block, including the 4 byte header, is always a multiple of
-8 bytes. Richard Sharpe.)
-
-Records in the hbin-blocks
-==========================
-
-nk-Record
-
-      The nk-record can be treated as a kombination of tree-record and
-      key-record of the win 95 registry.
-
-lf-Record
-
-      The lf-record is the counterpart to the RGKN-record (the
-      hash-function)
-
-vk-Record
-
-      The vk-record consists information to a single value.
-
-sk-Record
-
-      sk (? Security Key ?) is the ACL of the registry.
-
-Value-Lists
-
-      The value-lists contain information about which values are inside a
-      sub-key and dont have a header.
-
-Datas
-
-      The datas of the registry are (like the value-list) stored without a
-      header.
-
-All offset-values are relative to the first hbin-block and point to the
-block-size field of the record-entry. to get the file offset, you have to add
-the header size (4kb) and the size field (4 bytes)...
-
-the nk-Record
-=============
-Offset      Size      Contents
-0x0000      Word      ID: ASCII-"nk" = 0x6B6E
-0x0002      Word      for the root-key: 0x2C, otherwise 0x20  //key symbolic links 0x10. Nigel
-0x0004      Q-Word      write-date/time in windows nt notation
-0x0010      D-Word      Offset of Owner/Parent key
-0x0014      D-Word      number of sub-Keys
-0x001C      D-Word      Offset of the sub-key lf-Records
-0x0024      D-Word      number of values
-0x0028      D-Word      Offset of the Value-List
-0x002C      D-Word      Offset of the sk-Record
-
-0x0030      D-Word      Offset of the Class-Name //see NK structure for the use of these fields. Nigel
-0x0044      D-Word      Unused (data-trash)  //some kind of run time index. Does not appear to be important. Nigel
-0x0048      Word      name-length
-0x004A      Word      class-name length
-0x004C      ????      key-name
-
-the Value-List
-==============
-Offset      Size      Contents
-0x0000      D-Word      Offset 1st Value
-0x0004      D-Word      Offset 2nd Value
-0x????      D-Word      Offset nth Value
-
-To determine the number of values, you have to look at the owner-nk-record!
-
-Der vk-Record
-=============
-Offset      Size      Contents
-0x0000      Word      ID: ASCII-"vk" = 0x6B76
-0x0002      Word      name length
-0x0004      D-Word      length of the data   //if top bit is set when offset contains data. Nigel
-0x0008      D-Word      Offset of Data
-0x000C      D-Word      Type of value
-0x0010      Word      Flag
-0x0012      Word      Unused (data-trash)
-0x0014      ????      Name
-
-If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
-
-If the data-size is lower 5, the data-offset value is used to store the data itself!
-
-The data-types
-==============
-Wert      Beteutung
-0x0001      RegSZ:             character string (in UNICODE!)
-0x0002      ExpandSZ:   string with "%var%" expanding (UNICODE!)
-0x0003      RegBin:           raw-binary value
-0x0004      RegDWord:   Dword
-0x0007      RegMultiSZ:      multiple strings, seperated with 0
-                  (UNICODE!)
-
-The "lf"-record
-===============
-Offset      Size      Contents
-0x0000      Word      ID: ASCII-"lf" = 0x666C
-0x0002      Word      number of keys
-0x0004      ????      Hash-Records
-
-Hash-Record
-===========
-Offset      Size      Contents
-0x0000      D-Word      Offset of corresponding "nk"-Record
-0x0004      D-Word      ASCII: the first 4 characters of the key-name, padded with 0-s. Case sensitiv!
-
-Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the 
-key-name you have to change the hash-value too!
-
-//These hashrecords must be sorted low to high within the lf record. Nigel.
-
-The "sk"-block
-==============
-(due to the complexity of the SAM-info, not clear jet)
-(This is just a self-relative security descriptor in the data. R Sharpe.) 
-
-
-Offset      Size      Contents
-0x0000      Word      ID: ASCII-"sk" = 0x6B73
-0x0002      Word      Unused
-0x0004      D-Word      Offset of previous "sk"-Record
-0x0008      D-Word      Offset of next "sk"-Record
-0x000C      D-Word      usage-counter
-0x0010      D-Word      Size of "sk"-record in bytes
-????                                             //standard self
-relative security desciptor. Nigel
-????  ????      Security and auditing settings...
-????
-
-The usage counter counts the number of references to this
-"sk"-record. You can use one "sk"-record for the entire registry!
-
-Windows nt date/time format
-===========================
-The time-format is a 64-bit integer which is incremented every
-0,0000001 seconds by 1 (I dont know how accurate it really is!)
-It starts with 0 at the 1st of january 1601 0:00! All values are
-stored in GMT time! The time-zone is important to get the real
-time!
-
-Common values for win95 and win-nt
-==================================
-Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
-If a value has no name (length=0, flag(bit 0)=0), it is treated as the
-"Default" entry...
-If a value has no data (length=0), it is displayed as empty.
-
-simplyfied win-3.?? registry:
-=============================
-
-+-----------+
-| next rec. |---+                      +----->+------------+
-| first sub |   |                      |      | Usage cnt. |
-| name      |   |  +-->+------------+  |      | length     |
-| value     |   |  |   | next rec.  |  |      | text       |------->+-------+
-+-----------+   |  |   | name rec.  |--+      +------------+        | xxxxx |
-   +------------+  |   | value rec. |-------->+------------+        +-------+
-   v               |   +------------+         | Usage cnt. |
-+-----------+      |                          | length     |
-| next rec. |      |                          | text       |------->+-------+
-| first sub |------+                          +------------+        | xxxxx |
-| name      |                                                       +-------+
-| value     |
-+-----------+    
-
-Greatly simplyfied structure of the nt-registry:
-================================================
-   
-+---------------------------------------------------------------+
-|                                                               |
-v                                                               |
-+---------+     +---------->+-----------+  +----->+---------+   |
-| "nk"    |     |           | lf-rec.   |  |      | nk-rec. |   |
-| ID      |     |           | # of keys |  |      | parent  |---+
-| Date    |     |           | 1st key   |--+      | ....    |
-| parent  |     |           +-----------+         +---------+
-| suk-keys|-----+
-| values  |--------------------->+----------+
-| SK-rec. |---------------+      | 1. value |--> +----------+
-| class   |--+            |      +----------+    | vk-rec.  |
-+---------+  |            |                      | ....     |
-             v            |                      | data     |--> +-------+
-      +------------+      |                      +----------+    | xxxxx |
-      | Class name |      |                                      +-------+
-      +------------+      |
-                          v
-          +---------+    +---------+
-   +----->| next sk |--->| Next sk |--+
-   |  +---| prev sk |<---| prev sk |  |
-   |  |   | ....    |    | ...     |  |
-   |  |   +---------+    +---------+  |
-   |  |                    ^          |
-   |  |                    |          |
-   |  +--------------------+          |
-   +----------------------------------+
-
----------------------------------------------------------------------------
-
-Hope this helps....  (Although it was *fun* for me to uncover this things,
-                  it took me several sleepless nights ;)
-
-            B.D.
