Reg to hive convert add extra ,00,00 on some value data hex

[fpe1]

Hello,
I used HiveSwarming_x86 v1.3 to convert a whole windows 10 SYSTEM hive (REG keys to hive) and then I compared the result with the original SYSTEM hive and I found on few value data entries it add extra ,00,00 at the end of the value data hex. I don't know if this is an issue but you can check my test reg files and test it.

For example I converted this registry key .reg to hive:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\afunix\Parameters\Winsock\0]
"szProtocol"=hex(2):41,00,46,00,5f,00,55,00,4e,00,49,00,58,00

Then the result hive file if add it to registry or if convert it back hive to .reg is:
Windows Registry Editor Version 5.00

[(HiveRoot)]
"szProtocol"=hex(2):41,00,46,00,5f,00,55,00,4e,00,49,00,58,00,00,00

So it added extra ,00,00 at the end of the data value hex.

I attached archive with 3 reg file test.reg and the result.reg after the convertion so you can test it.

testREG.zip

[salsifis]

Hello,

Thank you for this bug report!

It was indeed a bug. Actually, the Win32 API function that writes a registry value (RegSetValueExW) is doing a bad thing: it changes the binary data to make it conformant to what is usually expected for some types of values.

This is not desirable in this program, so I replaced the call to that function with the system call NtSetValueKey directly.

This should be fixed in version 1.4.
Can you try and tell me if that version is OK?

[salsifis]

Hello @fpe1,

Could you try the version 1.4 and did it solve the issue?

Should you not answer within a week I will probably close the ticket.
Thanks.

[fpe1]

Hello @salsifis
sorry for the long delay, I test it now and this problem is resolved. Thanks.