diff --git a/trunk/mainwindow.cpp b/trunk/mainwindow.cpp
index dbe1468..fc075ab 100644
--- a/trunk/mainwindow.cpp
+++ b/trunk/mainwindow.cpp
@@ -1,560 +1,575 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef FRED_REPORT_TEMPLATE_DIR
   #define FRED_REPORT_TEMPLATE_DIR "/usr/share/fred/report_templates/"
 #endif
 
 #include <QFileDialog>
 #include <QMessageBox>
 #include <QStringList>
 #include <QDesktopWidget>
 #include <QDir>
 #include <QSplitter>
 
 #include "mainwindow.h"
 #include "ui_mainwindow.h"
 #include "dlgabout.h"
 #include "dlgkeydetails.h"
 #include "dlgreportviewer.h"
 #include "dlgsearch.h"
 
 #include "compileinfo.h"
 
 MainWindow::MainWindow(QWidget *parent) :
   QMainWindow(parent), ui(new Ui::MainWindow)
 {
   ui->setupUi(this);
 
   // Initialize private vars
   this->p_hive=new RegistryHive(this);
   this->is_hive_open=false;
   this->p_reg_node_tree_model=NULL;
   this->p_reg_key_table_model=NULL;
 
   // Check for ~/.fred config dir
   this->CheckUserConfigDir();
 
   // Set main window size
   int cur_screen=QApplication::desktop()->screenNumber(this);
   int window_width=
     QApplication::desktop()->availableGeometry(cur_screen).width()*0.5;
   int window_height=
     QApplication::desktop()->availableGeometry(cur_screen).height()*0.5;
   int window_x=
     (QApplication::desktop()->availableGeometry(cur_screen).width()/2)-
     (window_width/2);
   int window_y=
     (QApplication::desktop()->availableGeometry(cur_screen).height()/2)-
     (window_height/2);
   this->setGeometry(window_x,
                     window_y,
                     window_width,
                     window_height);
 
   // Create widgets
   this->p_horizontal_splitter=new QSplitter();
   this->p_horizontal_splitter->setOrientation(Qt::Horizontal);
 
   this->p_node_tree=new RegistryNodeTree(this->p_horizontal_splitter);
   this->p_node_tree->setHeaderHidden(true);
 
   this->p_vertical_splitter=new QSplitter(this->p_horizontal_splitter);
   this->p_vertical_splitter->setOrientation(Qt::Vertical);
 
   this->p_key_table=new RegistryKeyTable(this->p_vertical_splitter);
 
   this->p_tab_widget=new QTabWidget(this->p_vertical_splitter);
 
   this->p_horizontal_splitter2=new QSplitter();
   this->p_horizontal_splitter2->setOrientation(Qt::Horizontal);
 
   this->p_hex_edit_widget=new QWidget(this->p_horizontal_splitter2);
   this->p_hex_edit_layout=new QVBoxLayout(this->p_hex_edit_widget);
   this->p_hex_edit_layout->setContentsMargins(0,0,0,0);
   this->p_hex_edit=new QHexEdit();
   this->p_hex_edit->setReadOnly(true);
   this->p_hex_edit_status_bar=new QLabel();
 
   this->p_data_interpreter=new DataInterpreter(this->p_horizontal_splitter2);
 
   // Make sure hex viewer font is monospaced.
   QFont mono_font("Monospace");
   mono_font.setStyleHint(QFont::TypeWriter);
   this->p_hex_edit->setFont(mono_font);
 
   // Add hexedit page to tab_widget
   this->p_tab_widget->insertTab(0,
                                 this->p_horizontal_splitter2,
                                 tr("Hex viewer"));
 
   // Lay out widgets
   this->p_hex_edit_layout->addWidget(this->p_hex_edit);
   this->p_hex_edit_layout->addWidget(this->p_hex_edit_status_bar);
 
   this->p_horizontal_splitter2->addWidget(this->p_hex_edit_widget);
   this->p_horizontal_splitter2->addWidget(this->p_data_interpreter);
 
   this->p_vertical_splitter->addWidget(this->p_key_table);
   this->p_vertical_splitter->addWidget(this->p_tab_widget);
 
   this->p_horizontal_splitter->addWidget(this->p_node_tree);
   this->p_horizontal_splitter->addWidget(this->p_vertical_splitter);
 
   // Set stretch factors
   QSizePolicy node_tree_policy=this->p_node_tree->sizePolicy();
   node_tree_policy.setHorizontalStretch(1);
   node_tree_policy.setVerticalStretch(100);
   this->p_node_tree->setSizePolicy(node_tree_policy);
 
   QSizePolicy vertical_splitter_policy=this->p_vertical_splitter->sizePolicy();
   vertical_splitter_policy.setHorizontalStretch(4);
   vertical_splitter_policy.setVerticalStretch(100);
   this->p_vertical_splitter->setSizePolicy(vertical_splitter_policy);
 
   QSizePolicy key_table_policy=this->p_key_table->sizePolicy();
   key_table_policy.setVerticalStretch(5);
   key_table_policy.setHorizontalStretch(100);
   this->p_key_table->setSizePolicy(key_table_policy);
 
   QSizePolicy tab_widget_policy=this->p_tab_widget->sizePolicy();
   tab_widget_policy.setVerticalStretch(2);
   tab_widget_policy.setHorizontalStretch(200);
   this->p_tab_widget->setSizePolicy(tab_widget_policy);
 
   QSizePolicy hex_edit_widget_policy=this->p_hex_edit_widget->sizePolicy();
   hex_edit_widget_policy.setVerticalStretch(2);
   hex_edit_widget_policy.setHorizontalStretch(200);
   this->p_hex_edit_widget->setSizePolicy(hex_edit_widget_policy);
 
   QSizePolicy data_interpreter_policy=this->p_data_interpreter->sizePolicy();
   data_interpreter_policy.setVerticalStretch(2);
   data_interpreter_policy.setHorizontalStretch(0);
   this->p_data_interpreter->setSizePolicy(data_interpreter_policy);
 
   // Connect signals
   this->connect(this->p_node_tree,
                 SIGNAL(clicked(QModelIndex)),
                 this,
                 SLOT(SlotNodeTreeClicked(QModelIndex)));
   this->connect(this->p_node_tree,
                 SIGNAL(activated(QModelIndex)),
                 this,
                 SLOT(SlotNodeTreeClicked(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(clicked(QModelIndex)),
                 this,
                 SLOT(SlotKeyTableClicked(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(doubleClicked(QModelIndex)),
                 this,
                 SLOT(SlotKeyTableDoubleClicked(QModelIndex)));
   this->connect(this->p_hex_edit,
                 SIGNAL(currentAddressChanged(int)),
                 this,
                 SLOT(SlotHexEditAddressChanged(int)));
 
   // Add central widget
   this->setContentsMargins(4,4,4,0);
   this->setCentralWidget(this->p_horizontal_splitter);
 
   // Set window title
   this->UpdateWindowTitle();
 
   // Set last open location to home dir
   this->last_open_location=QDir::homePath();
 
   // Load report templates and update menu
   this->p_data_reporter=new DataReporter();
   // Load reports from system wide include dir
   this->p_data_reporter->LoadReportTemplates(FRED_REPORT_TEMPLATE_DIR);
   // Load user's report templates
   this->p_data_reporter->LoadReportTemplates(QDir::homePath()
                                                .append(QDir::separator())
                                                .append(".fred")
                                                .append(QDir::separator())
                                                .append("report_templates"));
   this->UpdateDataReporterMenu();
 
   // Finally, parse command line arguments
   this->ParseCommandLineArgs();
 }
 
 MainWindow::~MainWindow() {
   if(this->is_hive_open) {
     this->p_hive->Close();
   }
   delete ui;
 }
 
 void MainWindow::on_action_Quit_triggered() {
   qApp->exit();
 }
 
 void MainWindow::on_action_Open_hive_triggered() {
   QString hive_file="";
 
   hive_file=QFileDialog::getOpenFileName(this,
                                     tr("Open registry hive"),
                                     this->last_open_location,
                                     tr("All files (*)"));
   if(hive_file=="") return;
 
   this->OpenHive(hive_file);
 }
 
 void MainWindow::on_action_Close_hive_triggered() {
   if(this->is_hive_open) {
     // Delete models
     if(this->p_reg_node_tree_model!=NULL) {
       this->p_node_tree->setModel(NULL);
       delete this->p_reg_node_tree_model;
       this->p_reg_node_tree_model=NULL;
     }
     if(this->p_reg_key_table_model!=NULL) {
       this->p_key_table->setModel(NULL);
       delete this->p_reg_key_table_model;
       this->p_reg_key_table_model=NULL;
     }
 
     // Remove any data from hex edit and data interpreter
     this->p_hex_edit->setData(QByteArray());
     this->p_hex_edit_status_bar->setText("");
     this->p_data_interpreter->ClearValues();
 
     // Close hive
     this->p_hive->Close();
 
     this->is_hive_open=false;
     this->ui->action_Close_hive->setEnabled(false);
     this->ui->ActionSearch->setEnabled(false);
     this->ui->MenuReports->setEnabled(false);
     this->UpdateWindowTitle();
   }
 }
 
 void MainWindow::on_actionAbout_Qt_triggered() {
   QMessageBox::aboutQt(this,tr("About Qt"));
 }
 
 void MainWindow::on_actionAbout_fred_triggered() {
   DlgAbout dlg_about(this);
   dlg_about.exec();
 }
 
 void MainWindow::SlotNodeTreeClicked(QModelIndex index) {
   QString node_path;
 
   if(!index.isValid()) return;
 
   //Built node path
   node_path.clear();
   node_path=this->p_reg_node_tree_model->data(index,Qt::DisplayRole)
     .toString().prepend("\\");
   while(this->p_reg_node_tree_model->parent(index)!=QModelIndex()) {
     // Prepend all parent nodes
     index=this->p_reg_node_tree_model->parent(index);
     node_path.prepend(this->p_reg_node_tree_model->data(index,Qt::DisplayRole)
                         .toString().prepend("\\"));
   }
 
   // Create table model and attach it to the table view
   if(this->p_reg_key_table_model!=NULL) {
     this->p_key_table->setModel(NULL);
     delete this->p_reg_key_table_model;
     this->p_hex_edit->setData(QByteArray());
     this->p_hex_edit_status_bar->setText("");
     this->p_data_interpreter->ClearValues();
   }
   this->p_reg_key_table_model=new RegistryKeyTableModel(this->p_hive,node_path);
   this->p_key_table->setModel(this->p_reg_key_table_model);
 }
 
 void MainWindow::SlotKeyTableDoubleClicked(QModelIndex index) {
   Q_UNUSED(index);
   /*
   QModelIndex key_index;
   QModelIndex node_index;
   QStringList nodes;
 
   QString key_name;
   QString key_type;
   QByteArray key_value;
 
   if(!index.isValid()) return;
 
   // Get key name, type and value
   key_index=this->p_reg_key_table_model->index(index.row(),0);
   key_name=this->p_reg_key_table_model->data(key_index,Qt::DisplayRole)
     .toString();
   key_index=this->p_reg_key_table_model->index(index.row(),1);
   key_type=this->p_reg_key_table_model->data(key_index,Qt::DisplayRole)
     .toString();
   key_index=this->p_reg_key_table_model->index(index.row(),2);
   key_value=this->p_reg_key_table_model->data(key_index,
                                               RegistryKeyTableModel::
                                                 AdditionalRoles_GetRawData)
     .toByteArray();
 
   // Get current node
   node_index=this->p_node_tree->currentIndex();
 
   //Built node path
   nodes.clear();
   nodes.append(this->p_reg_node_tree_model->
                  data(node_index,Qt::DisplayRole).toString());
   while(this->p_reg_node_tree_model->parent(node_index)!=QModelIndex()) {
     // Prepend all parent nodes
     node_index=this->p_reg_node_tree_model->parent(node_index);
     nodes.prepend(this->p_reg_node_tree_model->
                   data(node_index,Qt::DisplayRole).toString());
   }
 
   DlgKeyDetails dlg_key_details(this);
   dlg_key_details.SetValues(nodes,key_name,key_type,key_value);
   dlg_key_details.exec();
   */
 }
 
 void MainWindow::SlotKeyTableClicked(QModelIndex index) {
   if(!index.isValid()) return;
 
   this->selected_key_value=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),2),
                                       RegistryKeyTableModel::
                                         AdditionalRoles_GetRawData)
                                           .toByteArray();
   this->p_hex_edit->setData(this->selected_key_value);
 }
 
 void MainWindow::SlotHexEditAddressChanged(int hex_offset) {
   if(!this->is_hive_open || this->selected_key_value.isEmpty()) return;
 
   // Update hex edit status bar
   this->p_hex_edit_status_bar->
     setText(QString().sprintf("Byte offset: 0x%04X (%u)",hex_offset,hex_offset));
   // Update data interpreter
   this->UpdateDataInterpreter(hex_offset);
 }
 
 void MainWindow::SlotReportClicked() {
   // Get report category and name from sender and it's parent
   QString category=((QMenu*)((QAction*)QObject::sender())->parent())->title();
   QString report=((QAction*)QObject::sender())->text();
 
   // Generate report
   QString report_content=this->p_data_reporter->GenerateReport(this->p_hive,
                                                                category,
                                                                report);
 
   // Show result in report viewer
   if(report_content!=QString()) {
     DlgReportViewer *p_dlg_report_view=new DlgReportViewer(report_content,this);
     p_dlg_report_view->exec();
     delete p_dlg_report_view;
   } else {
     // TODO: Something went wrong!
   }
 }
 
+void MainWindow::SlotFoundMatch(ThreadSearch::eMatchType match_type,
+                                QString path,
+                                QString key,
+                                QString value)
+{
+  qDebug("Found match: path='%s'",path.toAscii().constData());
+}
+
 void MainWindow::CheckUserConfigDir() {
   QString user_config_dir=QDir::homePath()
                             .append(QDir::separator())
                             .append(".fred");
   if(!QDir(user_config_dir).exists()) {
     // User config dir does not exists, try to create it
     if(!QDir().mkpath(user_config_dir)) {
       // TODO: Maybe warn user
       return;
     }
     user_config_dir.append(QDir::separator()).append("report_templates");
     if(!QDir().mkpath(user_config_dir)) {
       // TODO: Maybe warn user
       return;
     }
   }
 }
 
 void MainWindow::UpdateWindowTitle(QString filename) {
   if(filename=="") {
     this->setWindowTitle(QString().sprintf("%s v%s",APP_TITLE,APP_VERSION));
   } else {
     this->setWindowTitle(QString().sprintf("%s v%s - %s",
                                            APP_TITLE,
                                            APP_VERSION,
                                            filename.toLocal8Bit().constData()));
   }
 }
 
 void MainWindow::UpdateDataInterpreter(int hex_offset) {
   QDateTime date_time;
   const char *p_data;
   int remaining_data_len;
 
   // Remove all old values from data interpreter
   this->p_data_interpreter->ClearValues();
 
   // Calculate how many bytes are remainig after current offset
   remaining_data_len=this->selected_key_value.size()-hex_offset;
   if(!remaining_data_len>0) {
     // Nothing to show
     return;
   }
 
   // Get pointer to data at current offset
   p_data=this->selected_key_value.constData();
   p_data+=hex_offset;
 
   //#define rotl32(x,n)   (((x) << n) | ((x) >> (32 - n)))
   //#define rotr32(x,n)   (((x) >> n) | ((x) << (32 - n)))
   //#define rotl64(x,n)   (((x) << n) | ((x) >> (64 - n)))
   //#define rotr64(x,n)   (((x) >> n) | ((x) << (64 - n)))
 
   if(remaining_data_len>=1) {
     this->p_data_interpreter->AddValue("int8:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "int8",
                                          hex_offset));
     this->p_data_interpreter->AddValue("uint8:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "uint8",
                                          hex_offset));
   }
   if(remaining_data_len>=2) {
     this->p_data_interpreter->AddValue("int16:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "int16",
                                          hex_offset));
     this->p_data_interpreter->AddValue("uint16:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "uint16",
                                          hex_offset));
   }
   if(remaining_data_len>=4) {
     this->p_data_interpreter->AddValue("int32:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "int32",
                                          hex_offset));
     this->p_data_interpreter->AddValue("uint32:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "uint32",
                                          hex_offset));
     this->p_data_interpreter->AddValue("unixtime:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "unixtime",
                                          hex_offset));
   }
   if(remaining_data_len>=8) {
     this->p_data_interpreter->AddValue("int64:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "int64",
                                          hex_offset));
     this->p_data_interpreter->AddValue("uint64:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "uint64",
                                          hex_offset));
     this->p_data_interpreter->AddValue("filetime64:",
                                        RegistryHive::KeyValueToString(
                                          this->selected_key_value,
                                          "filetime",
                                          hex_offset));
   }
 
   //#undef rotl32
   //#undef rotl64
 }
 
 void MainWindow::UpdateDataReporterMenu() {
   int i=0,ii=0;
   QMenu *p_category_entry;
   QAction *p_report_entry;
 
   QStringList categories=this->p_data_reporter->GetAvailableReportCategories();
   QStringList reports;
 
   for(i=0;i<categories.count();i++) {
     // First create category submenu
     p_category_entry=this->ui->MenuReports->addMenu(categories.value(i));
     // Now add category reports
     reports=this->p_data_reporter->GetAvailableReports(categories.value(i));
     for(ii=0;ii<reports.count();ii++) {
       p_report_entry=new QAction(reports.value(ii),p_category_entry);
       p_category_entry->addAction(p_report_entry);
       this->connect(p_report_entry,
                     SIGNAL(triggered()),
                     this,
                     SLOT(SlotReportClicked()));
     }
   }
 }
 
 void MainWindow::OpenHive(QString hive_file) {
   // Update last open location
   this->last_open_location=hive_file.left(hive_file.
                                             lastIndexOf(QDir::separator()));
 
   // If another hive is currently open, close it
   if(this->is_hive_open) this->on_action_Close_hive_triggered();
 
   // Try to open hive
   if(!this->p_hive->Open(hive_file)) {
     QMessageBox::critical(this,
                           tr("Error opening hive file"),
                           tr("Unable to open file '%1'").arg(hive_file));
     return;
   }
 
   // Create tree model
   this->p_reg_node_tree_model=
     new RegistryNodeTreeModel(this->p_hive);
   this->p_node_tree->setModel(this->p_reg_node_tree_model);
 
   this->is_hive_open=true;
   this->ui->action_Close_hive->setEnabled(true);
   this->ui->ActionSearch->setEnabled(true);
   this->ui->MenuReports->setEnabled(true);
   this->UpdateWindowTitle(hive_file);
 }
 
 void MainWindow::ParseCommandLineArgs() {
   QStringList args=qApp->arguments();
 
   // If exactly 1 argument was specified, it should be a hive to open
   if(args.count()==2) {
     this->OpenHive(args.at(1));
   }
 }
 
 void MainWindow::on_ActionSearch_triggered() {
   DlgSearch dlg_search(this);
   if(dlg_search.exec()==QDialog::Accepted) {
-    // TODO: Search
+    ThreadSearch *p_search_thread=new ThreadSearch(this);
+    this->connect(p_search_thread,
+                  SIGNAL(SignalFoundMatch(ThreadSearch::eMatchType,QString,QString,QString)),
+                  this,
+                  SLOT(SlotFoundMatch(ThreadSearch::eMatchType,QString,QString,QString)));
+    QList<QByteArray> keywords;
+    keywords.append(QByteArray(QString("Windows").toAscii()));
+    p_search_thread->Search(this->p_hive->Filename(),keywords,true,false,false);
   }
 }
diff --git a/trunk/mainwindow.h b/trunk/mainwindow.h
index 33fb797..f5f294b 100644
--- a/trunk/mainwindow.h
+++ b/trunk/mainwindow.h
@@ -1,132 +1,137 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef MAINWINDOW_H
 #define MAINWINDOW_H
 
 #include <QMainWindow>
 #include <QWidget>
 #include <QLabel>
 #include <QTabWidget>
 #include <QVBoxLayout>
 #include <QSplitter>
 
 #include <QString>
 #include <QByteArray>
 
 #include <hivex.h>
 
 #include "registryhive.h"
 #include "registrynodetree.h"
 #include "registrynodetreemodel.h"
 #include "registrykeytable.h"
 #include "registrykeytablemodel.h"
 #include "qhexedit/qhexedit.h"
 #include "datainterpreter.h"
 #include "datareporter.h"
+#include "threadsearch.h"
 
 namespace Ui {
   class MainWindow;
 }
 
 class MainWindow : public QMainWindow {
   Q_OBJECT
 
   public:
     explicit MainWindow(QWidget *parent = 0);
     ~MainWindow();
 
   private slots:
     void on_action_Quit_triggered();
     void on_action_Open_hive_triggered();
     void on_action_Close_hive_triggered();
     void on_actionAbout_Qt_triggered();
     void on_actionAbout_fred_triggered();
 
     void SlotNodeTreeClicked(QModelIndex index);
     void SlotKeyTableClicked(QModelIndex index);
     void SlotKeyTableDoubleClicked(QModelIndex index);
     void SlotHexEditAddressChanged(int hex_offset);
     void SlotReportClicked();
+    void SlotFoundMatch(ThreadSearch::eMatchType match_type,
+                        QString path,
+                        QString key,
+                        QString value);
 
     void on_ActionSearch_triggered();
 
 private:
     Ui::MainWindow *ui;
     QString last_open_location;
     RegistryHive *p_hive;
     bool is_hive_open;
     RegistryNodeTreeModel *p_reg_node_tree_model;
     RegistryKeyTableModel *p_reg_key_table_model;
     QByteArray selected_key_value;
 
     // Widgets etc...
     RegistryNodeTree *p_node_tree;
     RegistryKeyTable *p_key_table;
     QTabWidget *p_tab_widget;
     QWidget *p_hex_edit_widget;
     QHexEdit *p_hex_edit;
     QLabel *p_hex_edit_status_bar;
     DataInterpreter *p_data_interpreter;
     QVBoxLayout *p_hex_edit_layout;
     QSplitter *p_horizontal_splitter;
     QSplitter *p_horizontal_splitter2;
     QSplitter *p_vertical_splitter;
 
     DataReporter *p_data_reporter;
 
     /*
      * CheckUserConfigDir
      *
      * Checks for and possibly creates the ~/.fred directory
      */
     void CheckUserConfigDir();
     /*
      * UpdateWindowTitle
      *
      * Updates the window title
      */
     void UpdateWindowTitle(QString filename="");
     /*
      * UpdateDataInterpreter
      *
      * Update data interpreter
      */
     void UpdateDataInterpreter(int hex_offset);
     /*
      * UpdateDataReporterMenu
      *
      */
     void UpdateDataReporterMenu();
     /*
      * OpenHive
      *
      * Open a registry hive
      */
     void OpenHive(QString hive_file);
     /*
      * ParseCommandLineArgs
      *
      * Parse command line arguments
      */
     void ParseCommandLineArgs();
 };
 
 #endif // MAINWINDOW_H
diff --git a/trunk/registryhive.cpp b/trunk/registryhive.cpp
index f2b5819..551ef15 100644
--- a/trunk/registryhive.cpp
+++ b/trunk/registryhive.cpp
@@ -1,542 +1,547 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #include "registryhive.h"
 
 #include <QStringList>
 #include <QDateTime>
 
 #include <stdlib.h>
 
 /*
  * RegistryHive
  */
 RegistryHive::RegistryHive(QObject *p_parent) : QObject(p_parent) {
   this->erro_msg="";
   this->is_error=false;
   this->hive_file="";
   this->p_hive=NULL;
   this->is_hive_open=false;
 }
 
 /*
  * ~RegistryHive
  */
 RegistryHive::~RegistryHive() {
   if(this->is_hive_open) this->Close();
 }
 
 /*
  * Error
  */
 bool RegistryHive::Error() {
   return this->is_error;
 }
 
 /*
  * GetErrorMsg
  */
 QString RegistryHive::GetErrorMsg() {
   QString msg=this->erro_msg;
   this->erro_msg="";
   this->is_error=false;
   return msg;
 }
 
 /*
  * Open
  */
 bool RegistryHive::Open(QString file, bool read_only) {
   if(this->is_hive_open) return false;
 
   // Open hive file
   this->p_hive=hivex_open(file.toAscii().constData(),
                           read_only ? 0 : HIVEX_OPEN_WRITE);
   if(this->p_hive==NULL) return false;
 
   // Set local vars
   this->hive_file=file;
   this->is_hive_open=true;
 
   return true;
 }
 
 /*
  * Close
  */
 bool RegistryHive::Close(bool commit_changes) {
   if(this->is_hive_open) {
     if(commit_changes) {
       // Commit changes before closing hive.
       // TODO: Maybe it would be more secure to commit changes to a new file and
       // then move it over the original one.
       hivex_commit(this->p_hive,NULL,0);
     }
 
     // As hivex_close will _ALWAYS_ free the handle, we don't need the following
     // values anymore
     this->hive_file="";
     this->is_hive_open=false;
 
     // Close hive
     if(hivex_close(this->p_hive)!=0) return false;
   }
   return true;
 }
 
+QString RegistryHive::Filename() {
+  if(this->is_hive_open) return this->hive_file;
+  return QString();
+}
+
 /*
  * GetNodes
  */
 QMap<QString,int> RegistryHive::GetNodes(QString path) {
   hive_node_h parent_node;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();
 
   // Get and return nodes
   return this->GetNodesHelper(parent_node);
 }
 
 /*
  * GetNodes
  */
 QMap<QString,int> RegistryHive::GetNodes(int parent_node) {
   if(parent_node==0) {
     this->SetError(tr("Invalid parent node handle specified!"));
     return QMap<QString,int>();
   }
 
   // Get and return nodes
   return this->GetNodesHelper(parent_node);
 }
 
 /*
  * GetKeys
  */
 QMap<QString,int> RegistryHive::GetKeys(QString path) {
   hive_node_h parent_node;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();
 
   // Get and return keys
   return this->GetKeysHelper(parent_node);
 }
 
 /*
  * GetKeys
  */
 QMap<QString,int> RegistryHive::GetKeys(int parent_node) {
   if(parent_node==0) {
     this->SetError(tr("Invalid parent node handle specified!"));
     return QMap<QString,int>();
   }
 
   // Get and return keys
   return this->GetKeysHelper(parent_node);
 }
 
 /*
  * GetKeyValue
  */
 QByteArray RegistryHive::GetKeyValue(QString path,
                                      QString key,
                                      int *p_value_type,
                                      size_t *p_value_len)
 {
   hive_node_h parent_node;
   hive_value_h hive_key;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QByteArray();
 
   // Get key handle
   hive_key=hivex_node_get_value(this->p_hive,
                                 parent_node,key.toAscii().constData());
   if(hive_key==0) {
     this->SetError(tr("Unable to get key handle!"));
     *p_value_len=-1;
     return QByteArray();
   }
 
   // Get and return key value
   return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
 }
 
 /*
  * GetKeyValue
  */
 QByteArray RegistryHive::GetKeyValue(int hive_key,
                                      int *p_value_type,
                                      size_t *p_value_len)
 {
   if(hive_key==0) {
     this->SetError(tr("Invalid key handle specified!"));
     *p_value_type=-1;
     return QByteArray();
   }
 
   // Get and return key value
   return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
 }
 
 /*
  * KeyValueToString
  */
 QString RegistryHive::KeyValueToString(QByteArray value, int value_type) {
   QString ret="";
   int i=0;
 
   #define ToHexStr() {                                                        \
     for(i=0;i<value.size();i++) {                                             \
       ret.append(QString().sprintf("%02X ",(uint8_t)(value.constData()[i]))); \
     }                                                                         \
     ret.chop(1);                                                              \
   }
 
   switch(value_type) {
     case hive_t_REG_NONE:
       // Just a key without a value, but to be certain...
       ToHexStr();
       break;
     case hive_t_REG_SZ:
       // A Windows string (encoding is unknown, but often UTF16-LE)
       // TODO: What happens if encoding is not UTF16-LE ??? Thx Billy!!!
       ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
       break;
     case hive_t_REG_EXPAND_SZ:
       // A Windows string that contains %env% (environment variable expansion)
       ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
       break;
     case hive_t_REG_BINARY:
       // A blob of binary
       ToHexStr();
       break;
     case hive_t_REG_DWORD:
       // DWORD (32 bit integer), little endian
       ret=QString().sprintf("0x%08X",*(uint32_t*)value.constData());
       //ret=QString().sprintf("0x%08X",value.toUInt());
       break;
     case hive_t_REG_DWORD_BIG_ENDIAN:
       // DWORD (32 bit integer), big endian
       ret=QString().sprintf("0x%08X",*(uint32_t*)value.constData());
       //ret=QString().sprintf("0x%08X",value.toUInt());
       break;
     case hive_t_REG_LINK:
       // Symbolic link to another part of the registry tree
       ToHexStr();
       break;
     case hive_t_REG_MULTI_SZ:
       // Multiple Windows strings.
       // See http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx
       ToHexStr();
       break;
     case hive_t_REG_RESOURCE_LIST:
       // Resource list
       ToHexStr();
       break;
     case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
       // Resource descriptor
       ToHexStr();
       break;
     case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
       // Resouce requirements list
       ToHexStr();
       break;
     case hive_t_REG_QWORD:
       // QWORD (64 bit integer). Usually little endian.
 #if __WORDSIZE == 64
       ret=QString().sprintf("0x%016lX",*(uint64_t*)value.constData());
 #else
       ret=QString().sprintf("0x%016llX",*(uint64_t*)value.constData());
 #endif
       break;
     default:
       ToHexStr();
   }
 
   #undef ToHexStr
 
   return ret;
 }
 
 /*
  * KeyValueToString
  */
 QString RegistryHive::KeyValueToString(QByteArray key_value,
                                        QString format,
                                        int offset,
                                        int length)
 {
   int remaining_data_len;
   const char *p_data;
   QString ret="";
 
   // Calculate how many bytes are remainig after specified offset
   remaining_data_len=key_value.size()-offset;
   if(!remaining_data_len>0) {
     // Nothing to show
     return QString();
   }
 
   // Get pointer to data at specified offset
   p_data=key_value.constData();
   p_data+=offset;
 
   // ConvertFull name
   if(format=="int8" && remaining_data_len>=1) {
     ret=QString().sprintf("%d",*(int8_t*)p_data);
   } else if(format=="uint8" && remaining_data_len>=1) {
     ret=QString().sprintf("%u",*(uint8_t*)p_data);
   } else if(format=="int16" && remaining_data_len>=2) {
     ret=QString().sprintf("%d",*(int16_t*)p_data);
   } else if(format=="uint16" && remaining_data_len>=2) {
     ret=QString().sprintf("%u",*(uint16_t*)p_data);
   } else if(format=="int32" && remaining_data_len>=4) {
     ret=QString().sprintf("%d",*(int32_t*)p_data);
   } else if(format=="uint32" && remaining_data_len>=4) {
     ret=QString().sprintf("%u",*(uint32_t*)p_data);
   } else if(format=="unixtime" && remaining_data_len>=4) {
     if(*(uint32_t*)p_data==0) {
       ret="n/a";
     } else {
       QDateTime date_time;
       date_time.setTime_t(*(uint32_t*)p_data);
       ret=date_time.toString("yyyy/MM/dd hh:mm:ss");
     }
   } else if(format=="int64" && remaining_data_len>=8) {
 #if __WORDSIZE == 64
     ret=QString().sprintf("%ld",*(int64_t*)p_data);
 #else
     ret=QString().sprintf("%lld",*(int64_t*)p_data);
 #endif
   } else if(format=="uint64" && remaining_data_len>=8) {
 #if __WORDSIZE == 64
     ret=QString().sprintf("%lu",*(uint64_t*)p_data);
 #else
     ret=QString().sprintf("%llu",*(uint64_t*)p_data);
 #endif
   } else if(format=="filetime" && remaining_data_len>=8) {
     if(*(uint64_t*)p_data==0) {
       ret="n/a";
     } else {
       // TODO: Warn if >32bit
       QDateTime date_time;
       date_time.setTime_t((*(uint64_t*)p_data-116444736000000000)/10000000);
       ret=date_time.toString("yyyy/MM/dd hh:mm:ss");
     }
   } else if(format=="ascii") {
     // TODO: This fails bad if the string is not null terminated!! It might be
     // wise checking for a null char here
     ret=QString().fromAscii((char*)p_data,length);
   } else if(format=="utf16" && remaining_data_len>=2) {
     ret=QString().fromUtf16((ushort*)p_data,length);
   } else {
     // Unknown variant type or another error
     return QString();
   }
 
   return ret;
 }
 
 /*
  * KeyTypeToString
  */
 QString RegistryHive::KeyTypeToString(int value_type) {
   QString ret="";
 
   switch(value_type) {
     case hive_t_REG_NONE:
       ret="REG_NONE";
       break;
     case hive_t_REG_SZ:
       ret="REG_SZ";
       break;
     case hive_t_REG_EXPAND_SZ:
       ret="REG_EXPAND_SZ";
       break;
     case hive_t_REG_BINARY:
       ret="REG_BINARY";
       break;
     case hive_t_REG_DWORD:
       ret="REG_DWORD";
       break;
     case hive_t_REG_DWORD_BIG_ENDIAN:
       ret="REG_DWORD_BIG_ENDIAN";
       break;
     case hive_t_REG_LINK:
       ret="REG_LINK";
       break;
     case hive_t_REG_MULTI_SZ:
       ret="REG_MULTI_SZ";
       break;
     case hive_t_REG_RESOURCE_LIST:
       ret="REG_RESOURCE_LIST";
       break;
     case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
       ret="REG_FULL_RESOURCE_DESC";
       break;
     case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
       ret="REG_RESOURCE_REQ_LIST";
       break;
     case hive_t_REG_QWORD:
       ret="REG_QWORD";
       break;
     default:
       ret=QString().sprintf("0x%08X",(uint32_t)value_type);
   }
 
   return ret;
 }
 
 /*
  * SetError
  */
 void RegistryHive::SetError(QString msg) {
   this->erro_msg=msg;
   this->is_error=true;
 }
 
 /*
  * GetNodeHandle
  */
 bool RegistryHive::GetNodeHandle(QString &path, hive_node_h *p_node) {
   QStringList nodes;
   int i=0;
 
   // Get root node handle
   *p_node=hivex_root(this->p_hive);
   if(*p_node==0) {
     this->SetError(tr("Unable to get root node!"));
     return false;
   }
 
   if(path!="\\") {
     // If we aren't listing the root node, we have to get a handle to the
     // last node in the path. Split path into nodes
     nodes=path.split('\\',QString::SkipEmptyParts);
 
     // Iterate to the correct parent node
     for(i=0;i<nodes.count();i++) {
       *p_node=hivex_node_get_child(this->p_hive,
                                    *p_node,
                                    nodes.value(i).toAscii().constData());
       if(*p_node==0) {
         this->SetError(tr("Unable to find node '%1'!").arg(nodes.value(i)));
         return false;
       }
     }
   }
 
   return true;
 }
 
 /*
  * GetNodesHelper
  */
 QMap<QString,int> RegistryHive::GetNodesHelper(hive_node_h parent_node) {
   QMap<QString,int> keys;
   char *p_name;
   int i=0;
 
   // Get child nodes
   hive_node_h *child_nodes=hivex_node_children(this->p_hive,parent_node);
   if(child_nodes==NULL) {
     this->SetError(
       tr("Unable to enumerate child nodes!"));
     return QMap<QString,int>();
   }
 
   // Build result
   keys.clear();
   i=0;
   while(child_nodes[i]) {
     p_name=hivex_node_name(this->p_hive,child_nodes[i]);
     if(p_name==NULL) {
       this->SetError(tr("Unable to get node name!"));
       free(child_nodes);
       return QMap<QString,int>();
     }
     keys.insert(QString(p_name),(int)child_nodes[i]);
     free(p_name);
     i++;
   }
   free(child_nodes);
 
   return keys;
 }
 
 /*
  * GetKeysHelper
  */
 QMap<QString,int> RegistryHive::GetKeysHelper(hive_node_h parent_node) {
   QMap<QString,int> keys;
   char *p_name;
   int i=0;
 
   // Get child keys
   hive_value_h *p_keys=hivex_node_values(this->p_hive,parent_node);
   if(p_keys==NULL) {
     this->SetError(
       tr("Unable to enumerate child keys!"));
     return QMap<QString,int>();
   }
 
   // Build result list
   keys.clear();
   i=0;
   while(p_keys[i]) {
     p_name=hivex_value_key(this->p_hive,p_keys[i]);
     if(p_name==NULL) {
       this->SetError(tr("Unable to get key name!"));
       return QMap<QString,int>();
     }
     keys.insert(QString(p_name),p_keys[i]);
     free(p_name);
     i++;
   }
   free(p_keys);
 
   return keys;
 }
 
 QByteArray RegistryHive::GetKeyValueHelper(hive_value_h hive_key,
                                            int *p_value_type,
                                            size_t *p_value_len)
 {
   QByteArray key_value;
   char *p_key_value;
 
   p_key_value=hivex_value_value(this->p_hive,
                                 hive_key,
                                 (hive_type*)p_value_type,
                                 p_value_len);
   if(p_key_value==NULL) {
     this->SetError(tr("Unable to get key value!"));
     *p_value_type=-1;
     return QByteArray();
   }
 
   // Feed QByteArray and free p_key_value
   key_value=QByteArray(p_key_value,*p_value_len);
   free(p_key_value);
 
   return key_value;
 }
diff --git a/trunk/registryhive.h b/trunk/registryhive.h
index ac60290..048be87 100644
--- a/trunk/registryhive.h
+++ b/trunk/registryhive.h
@@ -1,77 +1,79 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef REGISTRYHIVE_H
 #define REGISTRYHIVE_H
 
 #include <QObject>
 #include <QMap>
 
 #include <hivex.h>
 
 class RegistryHive : public QObject {
   Q_OBJECT
 
   public:
     explicit RegistryHive(QObject *p_parent=0);
     ~RegistryHive();
 
     bool Error();
     QString GetErrorMsg();
 
     bool Open(QString file, bool read_only=true);
     bool Close(bool commit_changes=false);
 
+    QString Filename();
+
     QMap<QString,int> GetNodes(QString path="\\");
     QMap<QString,int> GetNodes(int parent_node=0);
     QMap<QString,int> GetKeys(QString path="\\");
     QMap<QString,int> GetKeys(int parent_node=0);
     QByteArray GetKeyValue(QString path,
                            QString key,
                            int *p_value_type,
                            size_t *p_value_len);
     QByteArray GetKeyValue(int hive_key,
                            int *p_value_type,
                            size_t *p_value_len);
     static QString KeyValueToString(QByteArray value, int value_type);
     static QString KeyValueToString(QByteArray value,
                                     QString format,
                                     int offset=0,
                                     int length=0);
     static QString KeyTypeToString(int value_type);
 
   private:
     QString erro_msg;
     bool is_error;
     QString hive_file;
     hive_h *p_hive;
     bool is_hive_open;
 
     void SetError(QString msg);
     bool GetNodeHandle(QString &path, hive_node_h *p_node);
     QMap<QString,int> GetNodesHelper(hive_node_h parent_node);
     QMap<QString,int> GetKeysHelper(hive_node_h parent_node);
     QByteArray GetKeyValueHelper(hive_value_h hive_key,
                                  int *p_value_type,
                                  size_t *p_value_len);
 
 };
 
 #endif // REGISTRYHIVE_H
diff --git a/trunk/threadsearch.cpp b/trunk/threadsearch.cpp
index 23a06d7..2b7d6d4 100644
--- a/trunk/threadsearch.cpp
+++ b/trunk/threadsearch.cpp
@@ -1,79 +1,120 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #include "threadsearch.h"
 
 #include <QStringList>
 
 ThreadSearch::ThreadSearch(QObject *p_parent) : QThread(p_parent) {
   this->hive_file="";
   this->h_hive=NULL;
   this->keywords=QList<QByteArray>();
   this->search_nodes=false;
   this->search_keys=false;
   this->search_values=false;
   this->root_node=0;
 }
 
 bool ThreadSearch::Search(QString registry_hive,
                           QList<QByteArray> search_keywords,
                           bool search_node_names,
                           bool search_key_names,
                           bool search_key_values,
                           QString search_path)
 {
   this->hive_file=registry_hive;
   this->keywords=search_keywords;
   this->search_nodes=search_node_names;
   this->search_keys=search_key_names;
   this->search_values=search_key_values;
+  this->root_path=search_path;
 
   // Try to open hive
   this->h_hive=hivex_open(this->hive_file.toAscii().constData(),0);
   if(this->h_hive==NULL) return false;
 
   // Get root node
   this->root_node=hivex_root(this->h_hive);
   if(this->root_node==0) {
     hivex_close(this->h_hive);
     return false;
   }
 
-  // If a root path was specified, itearte to it
+  // If a root path was specified, iterate to it
   if(search_path!="\\") {
     QStringList path_nodes=search_path.split("\\",QString::SkipEmptyParts);
     int i;
     for(i=0;i<path_nodes.count();i++) {
       this->root_node=hivex_node_get_child(this->h_hive,
                                            this->root_node,
                                            path_nodes.at(i).toAscii().constData());
       if(this->root_node==0) {
         hivex_close(this->h_hive);
         return false;
       }
     }
   }
 
   this->start();
   return true;
 }
 
 void ThreadSearch::run() {
+  qDebug("Starting search");
+  this->Match(this->root_node,this->root_path=="\\" ? "" : this->root_path);
+  qDebug("Ending search");
+  hivex_close(this->h_hive);
+}
+
+void ThreadSearch::Match(hive_node_h node, QString path) {
+  char *p_node_name;
+  int i;
+  hive_node_h *p_node_childs;
+  QByteArray *p_byte_array;
+
+  //qDebug("Searching in '%s'",path.toAscii().constData());
+
+  p_node_name=hivex_node_name(this->h_hive,node);
+  if(p_node_name==NULL) return;
+
+  if(this->search_nodes) {
+    // Compare node name with keywords
+    p_byte_array=new QByteArray(p_node_name);
+    for(i=0;i<this->keywords.count();i++) {
+      if(p_byte_array->indexOf(this->keywords.at(i))!=-1) {
+        emit(SIGNAL(SignalFoundMatch(ThreadSearch::eMatchType_NodeName,
+                                     path,
+                                     QString(p_node_name),
+                                     QString())));
+      }
+    }
+    delete p_byte_array;
+  }
+
+  p_node_childs=hivex_node_children(this->h_hive,node);
+  if(p_node_childs!=NULL) {
+    for(i=0;p_node_childs[i];i++) {
+      this->Match(p_node_childs[i],
+                  QString(path).append("\\").append(p_node_name));
+    }
+    delete p_node_childs;
+  }
+  delete p_node_name;
 }
diff --git a/trunk/threadsearch.h b/trunk/threadsearch.h
index e64a35c..4686678 100644
--- a/trunk/threadsearch.h
+++ b/trunk/threadsearch.h
@@ -1,59 +1,75 @@
 /*******************************************************************************
 * fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>             *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef THREADSEARCH_H
 #define THREADSEARCH_H
 
 #include <QThread>
 #include <QObject>
+#include <QString>
 #include <QList>
 #include <QByteArray>
 
 #include <hivex.h>
 
 class ThreadSearch : public QThread {
   Q_OBJECT
 
   public:
+    enum eMatchType {
+      eMatchType_NodeName=0,
+      eMatchType_KeyName,
+      eMatchType_KeyValue
+    };
+
     ThreadSearch(QObject *p_parent=0);
 
     bool Search(QString registry_hive,
                 QList<QByteArray> search_keywords,
                 bool search_node_names,
                 bool search_key_names,
                 bool search_key_values,
                 QString search_path="\\");
 
+  signals:
+    void SignalFoundMatch(ThreadSearch::eMatchType match_type,
+                          QString path,
+                          QString key,
+                          QString value);
+
   protected:
     void run();
 
   private:
     QString hive_file;
     hive_h *h_hive;
     QList<QByteArray> keywords;
     bool search_nodes;
     bool search_keys;
     bool search_values;
+    QString root_path;
     hive_node_h root_node;
 
-
+    void Match(hive_node_h node, QString path);
 };
 
+//Q_DECLARE_TYPEINFO(ThreadSearch::eMatchType,Q_PRIMITIVE_TYPE);
+
 #endif // THREADSEARCH_H