diff --git a/trunk/debian/changelog b/trunk/debian/changelog
index e56d0f7..4e11672 100644
--- a/trunk/debian/changelog
+++ b/trunk/debian/changelog
@@ -1,50 +1,50 @@
-fred (0.1.0) stable; urgency=low
+fred (0.1.0beta5) stable; urgency=low
 
 fred (0.1.0beta4) unstable; urgency=low
 
   * Fixed some minor UI bugs
   * Massive code cleanup in mainwindow.cpp
   * Added ability to switch data interpreter's endianness
   * Added ability in hex editor to select and copy selected bytes / text
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Mon, 25 Jun 2012 00:00:00 +0200
 
 fred (0.1.0beta3) unstable; urgency=low
 
   * Added search functionality
   * Added various context menus to copy values to clipboard
   * Now linking statically against libhivex to support older Debian / Ubuntu distros
   * Some small fixes to ease portability
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Sun, 04 Sep 2011 00:15:00 +0200
 
 fred (0.1.0beta2) unstable; urgency=low
 
   * Fixed some more bugs and subclassed QTreeView and QTableView
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Tue, 23 Aug 2011 17:00:00 +0200
 
 fred (0.1.0beta1) unstable; urgency=low
 
   * Fixed some minor bugs and added more report templates
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Mon, 22 Aug 2011 08:00:00 +0200
 
 fred (0.1.0alpha3) unstable; urgency=low
 
   * Added data report engine and 2 basic report templates
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Wed, 17 Aug 2011 11:30:00 +0200
 
 fred (0.1.0alpha2) unstable; urgency=low
 
   * Integrated hexeditor into main window.
   * Added data interpreters
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Tue, 09 Aug 2011 17:00:00 +0200
 
 fred (0.1.0alpha1) unstable; urgency=low
 
   * First public release
 
  -- Daniel Gillen <gillen.dan@pinguin.lu>  Sat, 06 Aug 2011 22:00:00 +0200
diff --git a/trunk/dlgaddkey.cpp b/trunk/dlgaddkey.cpp
index 81253ad..f2a41d2 100644
--- a/trunk/dlgaddkey.cpp
+++ b/trunk/dlgaddkey.cpp
@@ -1,382 +1,379 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #include <QString>
 #include <QStringList>
 #include <QMessageBox>
 #include <QRegExp>
 #include <stdlib.h>
 
 #include <QDebug>
 
 #include "dlgaddkey.h"
 #include "ui_dlgaddkey.h"
 
 #include "registryhive.h"
 
 #define MACROS_ENDIANNESS
 #include "macros.h"
 
 DlgAddKey::DlgAddKey(QWidget *p_parent,
                      QString key_name,
                      QString key_value_type,
                      QByteArray key_value) :
   QDialog(p_parent),
   ui(new Ui::DlgAddKey)
 {
   this->p_current_widget=NULL;
   ui->setupUi(this);
+  this->ansi_encoded=false;
 
   // Create widgets
   this->CreateValueWidgets();
 
   // Set dialog title
   if(key_name.isEmpty() && key_value_type.isEmpty() && key_value.isEmpty()) {
     // If no values were passed, we consider this the ddd key dialog
     this->setWindowTitle(tr("Add key"));
   } else {
     // If a value was passed, this is considered the edit key dialog
     this->setWindowTitle(tr("Edit key"));
     this->ui->EdtKeyName->setEnabled(false);
     this->ui->CmbKeyType->setEnabled(false);
   }
 
   // Preload key value type values
   QStringList value_types=RegistryHive::GetKeyValueTypes();
   this->ui->CmbKeyType->addItems(value_types);
 
   // Load values
   if(!key_name.isEmpty()) this->ui->EdtKeyName->setText(key_name);
   if(!key_value_type.isEmpty())
     this->ui->CmbKeyType->setCurrentIndex(value_types.indexOf(key_value_type));
   if(!key_value.isEmpty()) this->SetValueWidgetData(key_value,key_value_type);
 }
 
 DlgAddKey::~DlgAddKey() {
   this->DestroyValueWidgets();
   delete ui;
 }
 
 QString DlgAddKey::KeyName() {
   return this->ui->EdtKeyName->text();
 }
 
 QString DlgAddKey::KeyType() {
   return this->ui->CmbKeyType->currentText();
 }
 
 QByteArray DlgAddKey::KeyValue() {
   return this->GetValueWidgetData();
 }
 
 void DlgAddKey::on_BtnCancel_clicked() {
   this->reject();
 }
 
 void DlgAddKey::on_BtnOk_clicked() {
   QString key_value_type=this->KeyType();
 
   // Check entered data for correctness
   if(key_value_type=="REG_MULTI_SZ") {
     // REG_MULTI_SZ's can't contain empty sub-strings
     QString cur_data=this->p_text_widget_text_edit->toPlainText();
     QString new_data=cur_data;
     // TODO: Do we need to check for \r\n on Windows??
     new_data.replace(QRegExp("\n\n*"),"\n");
     if(new_data.startsWith("\n")) new_data.remove(0,1);
     if(new_data.endsWith("\n")) new_data.chop(1);
     if(cur_data!=new_data) {
       if(QMessageBox::information(this,
                                   tr("Invalid data"),
-                                  tr("A REG_MULTI_SZ can not contain empty sub-strings! If you continue, they will be removed."),
+                                  tr("A REG_MULTI_SZ can not contain empty "
+                                       "sub-strings! If you continue, they "
+                                       "will be removed."),
                                   QMessageBox::Yes,
                                   QMessageBox::No)==QMessageBox::Yes)
       {
         this->p_text_widget_text_edit->setPlainText(new_data);
       } else {
         return;
       }
     }
   } else if(key_value_type=="REG_DWORD" ||
             key_value_type=="REG_DWORD_BIG_ENDIAN")
   {
     bool ok=false;
     if(this->p_number_widget_rb_decimal->isChecked()) {
       this->p_number_widget_line_edit->text().toInt(&ok);
     } else {
       // TODO: There seems to be a problem with 0xFFFFFFFF
       this->p_number_widget_line_edit->text().toInt(&ok,16);
     }
     if(!ok) {
       QMessageBox::information(this,
                                tr("Invalid data"),
-                               tr("The value you entered could not be converted to a %1! Please correct it.").arg(key_value_type),
+                               tr("The value you entered could not be "
+                                    "converted to a %1! Please correct it.")
+                                 .arg(key_value_type),
                                QMessageBox::Ok);
       return;
     }
   } else if(key_value_type=="REG_QWORD") {
     bool ok=false;
     if(this->p_number_widget_rb_decimal->isChecked()) {
       this->p_number_widget_line_edit->text().toLongLong(&ok);
     } else {
       this->p_number_widget_line_edit->text().toLongLong(&ok,16);
     }
     if(!ok) {
       QMessageBox::information(this,
                                tr("Invalid data"),
-                               tr("The value you entered could not be converted to a %1! Please correct it.").arg(key_value_type),
+                               tr("The value you entered could not be "
+                                    "converted to a %1! Please correct it.")
+                                 .arg(key_value_type),
                                QMessageBox::Ok);
       return;
     }
   }
 
   this->accept();
 }
 
 void DlgAddKey::on_CmbKeyType_currentIndexChanged(const QString &arg1) {
   // Remove current widget from grid layout
   if(this->p_current_widget!=NULL) {
     this->ui->gridLayout->removeWidget(this->p_current_widget);
     this->p_current_widget->setVisible(false);
     this->p_current_widget=NULL;
   }
 
   // Add new widget for selected value type
   if(arg1=="REG_SZ" || arg1=="REG_EXPAND_SZ") {
     // Line edit widget for REG_SZ and REG_EXPAND_SZ
     this->ui->gridLayout->addWidget(this->p_line_widget,2,1);
     this->p_current_widget=this->p_line_widget;
   } else if(arg1=="REG_MULTI_SZ") {
     // Text edit widget for REG_MULTI_SZ
     this->ui->gridLayout->addWidget(this->p_text_widget,2,1);
     this->p_current_widget=this->p_text_widget;
   } else if(arg1=="REG_DWORD" ||
             arg1=="REG_DWORD_BIG_ENDIAN" ||
             arg1=="REG_QWORD")
   {
     // Number widget for REG_DWORD, REG_DWORD_BIG_ENDIAN and REG_QWORD
     this->ui->gridLayout->addWidget(this->p_number_widget,2,1);
     this->p_current_widget=this->p_number_widget;
   } else if(arg1=="REG_BINARY" ||
             arg1=="REG_LINK" ||
             arg1=="REG_RESOURCE_LIST" ||
             arg1=="REG_FULL_RESOURCE_DESC" ||
             arg1=="REG_RESOURCE_REQ_LIST")
   {
     // Binary widget for all other types
     this->ui->gridLayout->addWidget(this->p_binary_widget,2,1);
     this->p_current_widget=this->p_binary_widget;
   }
 
   if(arg1!="REG_NONE") {
     this->p_current_widget->setVisible(true);
     this->ui->LblKeyValue->setVisible(true);
   } else {
     this->ui->LblKeyValue->setVisible(false);
   }
 }
 
 void DlgAddKey::CreateValueWidgets() {
   this->p_line_widget=new QWidget();
   this->p_line_widget_layout=new QHBoxLayout(this->p_line_widget);
+  //this->p_line_widget_layout_rb_ansi=new QRadioButton(tr("Ansi"));
+  //this->p_line_widget_layout_rb_unicode=new QRadioButton(tr("Unicode"));
+  //this->p_line_widget_layout_rb_unicode->setChecked(true);
   this->p_line_widget_line_edit=new QLineEdit();
   this->p_line_widget->setContentsMargins(0,0,0,0);
   this->p_line_widget_layout->setContentsMargins(0,0,0,0);
   this->p_line_widget_layout->addWidget(this->p_line_widget_line_edit);
+  //this->p_line_widget_layout->addWidget(this->p_line_widget_layout_rb_ansi);
+  //this->p_line_widget_layout->addWidget(this->p_line_widget_layout_rb_unicode);
 
   this->p_text_widget=new QWidget();
   this->p_text_widget_layout=new QHBoxLayout(this->p_text_widget);
   this->p_text_widget_text_edit=new QPlainTextEdit();
   this->p_text_widget->setContentsMargins(0,0,0,0);
   this->p_text_widget_layout->setContentsMargins(0,0,0,0);
   this->p_text_widget_layout->addWidget(this->p_text_widget_text_edit);
 
   this->p_number_widget=new QWidget();
   this->p_number_widget_layout=new QHBoxLayout(this->p_number_widget);
   this->p_number_widget_line_edit=new QLineEdit();
   this->p_number_widget_rb_decimal=new QRadioButton(tr("Dec base"));
   this->p_number_widget_rb_decimal->setChecked(true);
   this->p_number_widget_rb_hex=new QRadioButton(tr("Hex base"));
   this->p_number_widget->setContentsMargins(0,0,0,0);
   this->p_number_widget_layout->setContentsMargins(0,0,0,0);
   this->p_number_widget_layout->addWidget(this->p_number_widget_line_edit);
   this->p_number_widget_layout->addWidget(this->p_number_widget_rb_decimal);
   this->p_number_widget_layout->addWidget(this->p_number_widget_rb_hex);
 
   this->p_binary_widget=new QWidget();
   this->p_binary_widget_layout=new QHBoxLayout(this->p_binary_widget);
   this->p_binary_widget_hex_edit=new HexEditWidget(this,false,false);
   this->p_binary_widget->setContentsMargins(0,0,0,0);
   this->p_binary_widget_layout->setContentsMargins(0,0,0,0);
   this->p_binary_widget_layout->addWidget(this->p_binary_widget_hex_edit);
 }
 
 void DlgAddKey::DestroyValueWidgets() {
+  //delete this->p_line_widget_layout_rb_ansi;
+  //delete this->p_line_widget_layout_rb_unicode;
   delete this->p_line_widget_line_edit;
   delete this->p_line_widget_layout;
   delete this->p_line_widget;
 
   delete this->p_text_widget_text_edit;
   delete this->p_text_widget_layout;
   delete this->p_text_widget;
 
   delete this->p_number_widget_rb_hex;
   delete this->p_number_widget_rb_decimal;
   delete this->p_number_widget_line_edit;
   delete this->p_number_widget_layout;
   delete this->p_number_widget;
 
   delete this->p_binary_widget_hex_edit;
   delete this->p_binary_widget_layout;
   delete this->p_binary_widget;
 }
 
 void DlgAddKey::SetValueWidgetData(QByteArray &key_value,
                                    QString &key_value_type)
 {
   if(key_value_type=="REG_SZ" || key_value_type=="REG_EXPAND_SZ") {
     this->p_line_widget_line_edit->setText(
       RegistryHive::KeyValueToString(key_value,
                                      RegistryHive::StringToKeyValueType(
                                        key_value_type)));
   } else if(key_value_type=="REG_MULTI_SZ") {
-    // TODO: Switch to RegistryHive::KeyValueStringList
-    // TODO: Identify if this is UTF16 or UTF8 and remember it
-    QStringList strings=RegistryHive::KeyValueToStringList(key_value);
+    QStringList strings=
+      RegistryHive::KeyValueToStringList(key_value,&(this->ansi_encoded));
     this->p_text_widget_text_edit->setPlainText(strings.join("\n"));
   } else if(key_value_type=="REG_DWORD") {
     this->p_number_widget_line_edit->setText(
       RegistryHive::KeyValueToString(key_value,"int32"));
   } else if(key_value_type=="REG_DWORD_BIG_ENDIAN") {
     this->p_number_widget_line_edit->setText(
       RegistryHive::KeyValueToString(key_value,"int32",0,0,false));
   } else if(key_value_type=="REG_QWORD") {
     this->p_number_widget_line_edit->setText(
       RegistryHive::KeyValueToString(key_value,"int64",0,0,false));
   } else if(key_value_type=="REG_BINARY" ||
             key_value_type=="REG_LINK" ||
             key_value_type=="REG_RESOURCE_LIST" ||
             key_value_type=="REG_FULL_RESOURCE_DESC" ||
             key_value_type=="REG_RESOURCE_REQ_LIST")
   {
     this->p_binary_widget_hex_edit->SetData(key_value);
   }
 }
 
 QByteArray DlgAddKey::GetValueWidgetData() {
   QString key_value_type=this->KeyType();
 
   if(key_value_type=="REG_SZ" || key_value_type=="REG_EXPAND_SZ") {
     // TODO: Wouldn't it be wise to let the user choose the encoding?
     // Get data
     QString data=this->p_line_widget_line_edit->text();
     // Convert data to UTF16LE buffer
     uint16_t *p_buf=NULL;
     int buf_len=this->ToUtf16LeBuf(&p_buf,data.utf16(),data.size());
     if(p_buf==NULL || buf_len==0) {
       // TODO: Inform user there was an error???
       return QByteArray("\x00\x00",2);
     }
     // Construct ByteArray, free buffer and return
     QByteArray ret=QByteArray((char*)p_buf,buf_len);
     free(p_buf);
     return ret;
   } else if(key_value_type=="REG_MULTI_SZ") {
-    // TODO: Switch to RegistryHive::StringListToKeyValue
-    // TODO: Wouldn't it be wise to let the user choose the encoding?
-    // TODO: When editing, use same encoding as original data
-    QString data=this->p_text_widget_text_edit->toPlainText();
-    // Convert data to UTF16LE buffer
-    uint16_t *p_buf=NULL;
-    int buf_len=this->ToUtf16LeBuf(&p_buf,data.utf16(),data.size());
-    if(p_buf==NULL || buf_len==0) {
-      // TODO: Inform user there was an error???
-      return QByteArray("\x00\x00\x00\x00",4);
-    }
-    // Replace \n in buffer with \0 which actually converts it to a
-    // semi REG_MULTI_SZ :-)
+    // TODO: Let the user choose the encoding / endianness
     // TODO: Do we need to check for \r\n on Windows??
-    for(int i=0;i<buf_len;i++) {
-      if(LE32TOH(p_buf[i])==10) p_buf[i]=0;
-    }
-    // Construct ByteArray
-    QByteArray ret=QByteArray((char*)p_buf,buf_len);
-    // Append \0\0 to the end to make a real REG_MULTI_SZ
-    ret.append("\x00\x00",2);
-    // Free buffer and return
-    free(p_buf);
-    return ret;
+    return RegistryHive::StringListToKeyValue(
+      this->p_text_widget_text_edit->
+        toPlainText().split("\n",
+                            QString::SkipEmptyParts),
+      true,
+      this->ansi_encoded);
   } else if(key_value_type=="REG_DWORD" ||
             key_value_type=="REG_DWORD_BIG_ENDIAN")
   {
     int32_t val;
     if(this->p_number_widget_rb_decimal->isChecked()) {
       val=this->p_number_widget_line_edit->text().toInt();
     } else {
       val=this->p_number_widget_line_edit->text().toInt(0,16);
     }
     if(key_value_type=="REG_DWORD") val=HTOLE32(val);
     else val=HTOBE32(val);
     return QByteArray((char*)&val,4);
   } else if(key_value_type=="REG_QWORD") {
     int64_t val;
     if(this->p_number_widget_rb_decimal->isChecked()) {
       val=this->p_number_widget_line_edit->text().toLongLong();
     } else {
       val=this->p_number_widget_line_edit->text().toLongLong(0,16);
     }
     val=HTOLE64(val);
     return QByteArray((char*)&val,8);
   } else if(key_value_type=="REG_BINARY" ||
             key_value_type=="REG_LINK" ||
             key_value_type=="REG_RESOURCE_LIST" ||
             key_value_type=="REG_FULL_RESOURCE_DESC" ||
             key_value_type=="REG_RESOURCE_REQ_LIST")
   {
     return this->p_binary_widget_hex_edit->GetData();
   }
   return QByteArray();
 }
 
 int DlgAddKey::ToUtf16LeBuf(uint16_t **pp_buf,
                             const uint16_t *p_data,
                             int ascii_len)
 {
   // Calculate utf16 buffer size
   // TODO: This fails if there are chars that need more than 16bit!!
   int buf_len=(ascii_len*2)+2;
 
   // Alloc buffer and set to 0x00h
   *pp_buf=(uint16_t*)malloc(buf_len);
   if(*pp_buf==NULL) return 0;
   memset(*pp_buf,0,buf_len);
   if(ascii_len==0) {
     // Empty string, we're done (buffer contains \0\0)
     return buf_len;
   }
   // Fill buffer with UTF16 string (ignoring \0\0 at the end)
   memcpy(*pp_buf,p_data,buf_len-2);
   // Make sure endianness is LE
   for(int i=0;i<ascii_len;i++) {
     (*pp_buf)[i]=HTOLE16((*pp_buf)[i]);
   }
 
   return buf_len;
 }
diff --git a/trunk/dlgaddkey.h b/trunk/dlgaddkey.h
index 136fad8..d7e7ac8 100644
--- a/trunk/dlgaddkey.h
+++ b/trunk/dlgaddkey.h
@@ -1,83 +1,86 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef DLGADDKEY_H
 #define DLGADDKEY_H
 
 #include <QDialog>
 #include <QWidget>
 #include <QHBoxLayout>
 #include <QLineEdit>
 #include <QPlainTextEdit>
 #include <QRadioButton>
 
 #include <inttypes.h>
 
 #include "hexeditwidget.h"
 
 namespace Ui {
   class DlgAddKey;
 }
 
 class DlgAddKey : public QDialog {
   Q_OBJECT
 
   public:
     explicit DlgAddKey(QWidget *p_parent=0,
                        QString key_name=QString(),
                        QString key_value_type=QString(),
                        QByteArray key_value=QByteArray());
     ~DlgAddKey();
 
     QString KeyName();
     QString KeyType();
     QByteArray KeyValue();
 
   private slots:
     void on_BtnCancel_clicked();
     void on_BtnOk_clicked();
     void on_CmbKeyType_currentIndexChanged(const QString &arg1);
 
   private:
     Ui::DlgAddKey *ui;
     QWidget *p_current_widget;
     QWidget *p_line_widget;
     QHBoxLayout *p_line_widget_layout;
+    //QRadioButton *p_line_widget_layout_rb_ansi;
+    //QRadioButton *p_line_widget_layout_rb_unicode;
     QLineEdit *p_line_widget_line_edit;
     QWidget *p_text_widget;
     QHBoxLayout *p_text_widget_layout;
     QPlainTextEdit *p_text_widget_text_edit;
     QWidget *p_number_widget;
     QHBoxLayout *p_number_widget_layout;
     QLineEdit *p_number_widget_line_edit;
     QRadioButton *p_number_widget_rb_decimal;
     QRadioButton *p_number_widget_rb_hex;
     QWidget *p_binary_widget;
     QHBoxLayout *p_binary_widget_layout;
     HexEditWidget *p_binary_widget_hex_edit;
+    bool ansi_encoded;
 
     void CreateValueWidgets();
     void DestroyValueWidgets();
     void SetValueWidgetData(QByteArray &key_value, QString &key_value_type);
     QByteArray GetValueWidgetData();
     int ToUtf16LeBuf(uint16_t **pp_buf,const uint16_t *p_data, int ascii_len);
 };
 
 #endif // DLGADDKEY_H
diff --git a/trunk/macros.h b/trunk/macros.h
index 64902a7..681c425 100644
--- a/trunk/macros.h
+++ b/trunk/macros.h
@@ -1,263 +1,288 @@
 /*******************************************************************************
 * Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu>                  *
 *                                                                              *
 * This file contains macros with some very often used code pieces. It should   *
 * primarily make my everyday life easier and improve code portability.         *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 // Available macro groups:
 //
 // MACROS_FILE, MACROS_STRING, MACROS_WSTRING, MACROS_ENDIANNESS, MACROS_MUTEX,
 // MACROS_MEMORY, MACROS_LOGGING
 //
 // Define one or more of these before including this file to make them available
 
 #ifndef MACROS_H
 #define MACROS_H
 
 /*
  * Macros for file access
  */
 #ifdef MACROS_FILE
   #include <stdio.h>
 
   #undef FOPEN
   #ifndef __APPLE__
     #define FOPEN (FILE*)fopen64
   #else
     // Apple always uses fopen
     #define FOPEN (FILE*)fopen
   #endif // __APPLE__
   #undef FCLOSE
   #define FCLOSE(var,err_ret) { \
     if(fclose(var)!=0) { \
       LOG_ERROR("Couldn't close file!") \
       err_ret; \
     } \
   }
   #undef FSEEK
   #define FSEEK(hfile,off,whence,err_ret) { \
     if(fseeko(hfile,off,whence)!=0) { \
       LOG_ERROR("Couldn't seek to offset %u!",off); \
       err_ret; \
     } \
   }
   #undef FTELL
   #define FTELL(hfile,var,err_ret) { \
     if((var=ftello(hfile))==-1) { \
       LOG_ERROR("Unable to get file position!"); \
       err_ret; \
     } \
   }
   #undef FTELLSIZE
   #define FTELLSIZE(hfile,var,err_ret) { \
     FSEEK(hfile,0,SEEK_END,err_ret); \
     FTELL(hfile,var,err_ret); \
     rewind(hfile); \
   }
 #endif
 
 /*
  * Macros for string functions
  *
  * Will also include MACROS_MEMORY and MACROS_LOGGING
  */
 #ifdef MACROS_STRING
   #include <string.h>
 
   // These macros rely partly on memory macros, so those are needed too
   #define MACROS_MEMORY
 
   #undef STRSET
   #define STRSET(dst,src,err_ret) { \
     MALLOC(dst,char*,(strlen(src)+1)*sizeof(char),err_ret) \
     strcpy(dst,src); \
   }
   #undef STRNSET
   #define STRNSET(dst,src,size,err_ret) { \
     MALLOC(dst,char*,((size)+1)*sizeof(char),err_ret) \
     strncpy(dst,src,size); \
     (dst)[size]='\0'; \
   }
   #undef STRAPP
   #define STRAPP(var1,var2,err_ret) { \
     REALLOC(var1,char*,(strlen(var1)+strlen(var2)+1)*sizeof(char),err_ret) \
     strcpy((var1)+strlen(var1),var2); \
   }
   #undef STRNAPP
   #define STRNAPP(var1,var2,size,err_ret) { \
     REALLOC(var1,char*,(strlen(var1)+(size)+1)*sizeof(char),err_ret) \
     (var1)[strlen(var1)+(size)]='\0'; \
     strncpy((var1)+strlen(var1),var2,size); \
   }
 #endif
 
 /*
  * Macros for wide string functions
  *
  * Will also include MACROS_MEMORY and MACROS_LOGGING
  */
 #ifdef MACROS_WSTRING
   #include <string.h>
 
   // These macros rely partly on memory macros, so those are needed too
   #define MACROS_MEMORY
 
   #undef WSTRSET
   #define WSTRSET(dst,src,err_ret) { \
     MALLOC(dst,wchar_t*,(wcslen(src)+1)*sizeof(wchar_t),err_ret) \
     wcscpy(dst,src); \
   }
   #undef WSTRNSET
   #define WSTRNSET(dst,src,size,err_ret) { \
     MALLOC(dst,wchar_t*,((size)+1)*sizeof(wchar_t),err_ret) \
     wcsncpy(dst,src,size); \
     (dst)[size]=L'\0'; \
   }
 #endif
 
 /*
  * Macros for endianness conversion
  */
 #ifdef MACROS_ENDIANNESS
+  #include <inttypes.h>
   #include <endian.h>
 
   #undef LE16TOH
   #define LE16TOH(var) le16toh(var)
   #undef BE16TOH
   #define BE16TOH(var) be16toh(var)
   #undef LE32TOH
   #define LE32TOH(var) le32toh(var)
   #undef BE32TOH
   #define BE32TOH(var) be32toh(var)
   #undef LE64TOH
   #define LE64TOH(var) le64toh(var)
   #undef BE64TOH
   #define BE64TOH(var) be64toh(var)
   #undef HTOLE16
   #define HTOLE16(var) htole16(var)
   #undef HTOBE16
   #define HTOBE16(var) htobe16(var)
   #undef HTOLE32
   #define HTOLE32(var) htole32(var)
   #undef HTOBE32
   #define HTOBE32(var) htobe32(var)
   #undef HTOLE64
   #define HTOLE64(var) htole64(var)
   #undef HTOBE64
   #define HTOBE64(var) htobe64(var)
+  #undef UTF16LETOH
+  #define UTF16LETOH(buf,buf_len) {                                         \
+    for(int buf_off=0;buf_off<((buf_len)-1);buf_off+=2) {                   \
+      *((uint16_t*)((buf)+buf_off))=LE16TOH(*((uint16_t*)((buf)+buf_off))); \
+    }                                                                       \
+  }
+  #undef UTF16BETOH
+  #define UTF16BETOH(buf,buf_len) {                                         \
+    for(int buf_off=0;buf_off<((buf_len)-1);buf_off+=2) {                   \
+      *((uint16_t*)((buf)+buf_off))=BE16TOH(*((uint16_t*)((buf)+buf_off))); \
+    }                                                                       \
+  }
+  #undef HTOUTF16LE
+  #define HTOUTF16LE(buf,buf_len) {                                         \
+    for(int buf_off=0;buf_off<((buf_len)-1);buf_off+=2) {                   \
+      *((uint16_t*)((buf)+buf_off))=HTOLE16(*((uint16_t*)((buf)+buf_off))); \
+    }                                                                       \
+  }
+  #undef HTOUTF16BE
+  #define HTOUTF16BE(buf,buf_len) {                                         \
+    for(int buf_off=0;buf_off<((buf_len)-1);buf_off+=2) {                   \
+      *((uint16_t*)((buf)+buf_off))=HTOBE16(*((uint16_t*)((buf)+buf_off))); \
+    }                                                                       \
+  }
 #endif
 
 /*
  * Macros for mutex access
  */
 #ifdef MACROS_MUTEX
   #include <pthread.h>
 
   #undef MUTEX_INIT
   #define MUTEX_INIT(var) { \
     pthread_mutex_init(&(var),NULL); \
   }
   #undef MUTEX_DESTROY
   #define MUTEX_DESTROY(var) { \
     pthread_mutex_destroy(&(var)); \
   }
   #undef MUTEX_LOCK
   #define MUTEX_LOCK(var) { \
     pthread_mutex_lock(&(var)); \
   }
   #undef MUTEX_UNLOCK
   #define MUTEX_UNLOCK(var) { \
     pthread_mutex_unlock(&(var)); \
   }
 #endif
 
 /*
  * Macros for memory management
  *
  * Will also include MACROS_LOGGING!
  */
 #ifdef MACROS_MEMORY
   #include <stdlib.h>
 
   // These macros rely partly on logging macros, so those are needed too
   #define MACROS_LOGGING
 
   #undef MALLOC
   #define MALLOC(var,var_type,size,err_ret) { \
     (var)=(var_type)malloc(size); \
     if((var)==NULL) { \
       LOG_ERROR("Couldn't allocate memmory!\n"); \
       err_ret; \
     } \
   }
   #undef REALLOC
   #define REALLOC(var,var_type,size,err_ret) { \
     (var)=(var_type)realloc((var),size); \
     if((var)==NULL) { \
       LOG_ERROR("Couldn't allocate memmory!\n"); \
       err_ret; \
     } \
   }
   #undef FREE
   #define FREE(var) free(var)
 #endif
 
 /*
  * Macros to ease debugging and error reporting
  *
  * These require the following function to be implemented somewhere:
  *
  * #include <stdio.h>
  * #include <stdarg.h>
  *
  * static void LogMessage(char *p_message_type,
  *                        char *p_calling_function,
  *                        int line,
  *                        char *p_message,
  *                        ...)
  * {
  *   va_list VaList;
  *   // Print message "header"
  *   printf("%s: %s@%u : ",
  *          p_message_type,
  *          p_calling_function,
  *          line);
  *   // Print message with variable parameters
  *   va_start(VaList,p_message);
  *   vprintf(p_message,VaList);
  *   va_end(VaList);
  *   printf("\n");
  * }
  */
 #ifdef MACROS_LOGGING
   #undef LOG_ERROR
   #define LOG_ERROR(...) \
     LogMessage("ERROR",(char*)__FUNCTION__,__LINE__,__VA_ARGS__);
   #undef LOG_DEBUG
   #define LOG_DEBUG(...) { \
     LogMessage("DEBUG",(char*)__FUNCTION__,__LINE__,__VA_ARGS__); \
   }
 #endif
 
 #endif // MACROS_H
 
 /*
   ----- Change history -----
   20130611: * Added ability to only include specific macro groups.
   20110428: * Initial release.
 */
 
diff --git a/trunk/mainwindow.cpp b/trunk/mainwindow.cpp
index 06cdc6a..e49a326 100644
--- a/trunk/mainwindow.cpp
+++ b/trunk/mainwindow.cpp
@@ -1,1078 +1,1070 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
-#ifndef FRED_REPORT_TEMPLATE_DIR
-  #ifndef __MINGW32__
-    #define FRED_REPORT_TEMPLATE_DIR "/usr/share/fred/report_templates/"
-  #else
-    #define FRED_REPORT_TEMPLATE_DIR ".\\report_templates\\"
-  #endif
-#endif
-
 #include <QFileDialog>
 #include <QMessageBox>
 #include <QStringList>
 #include <QDesktopWidget>
 #include <QDir>
 #include <QSplitter>
 #include <QListIterator>
 #include <QInputDialog>
 
 #include <QDebug>
 
 #include "mainwindow.h"
 #include "ui_mainwindow.h"
 #include "dlgabout.h"
 #include "dlgreportchooser.h"
 #include "dlgreportviewer.h"
 #include "dlgsearch.h"
 #include "dlgpreferences.h"
 #include "dlgaddkey.h"
 
 #include "compileinfo.h"
 
 /*******************************************************************************
  * Public
  ******************************************************************************/
 
 /*
  * Constructor
  */
 MainWindow::MainWindow(ArgParser *p_arg_parser) :
   QMainWindow(0), ui(new Ui::MainWindow)
 {
   ui->setupUi(this);
 
   // Initialize private vars
   this->p_args=p_arg_parser;
   this->p_hive=new RegistryHive(this);
   this->is_hive_open=false;
   this->p_reg_node_tree_model=NULL;
   this->p_reg_node_tree_model_proxy=NULL;
   this->p_reg_key_table_model=NULL;
   this->p_search_thread=NULL;
   this->search_result_widgets.clear();
 
   // Init and load settings
   this->p_settings=new Settings(this);
   this->is_hive_writable=!this->p_settings->GetOpenHivesReadOnly();
 
   // Set main window size
   QByteArray geometry=this->p_settings->GetWindowGeometry("MainWindow");
   if(!geometry.isEmpty()) {
     // Restore saved geometry
     this->restoreGeometry(geometry);
   } else {
     // No saved geometry, calculate and set default
     int cur_screen=QApplication::desktop()->screenNumber(this);
     int window_width=
       QApplication::desktop()->availableGeometry(cur_screen).width()*0.5;
     int window_height=
       QApplication::desktop()->availableGeometry(cur_screen).height()*0.5;
     int window_x=
       (QApplication::desktop()->availableGeometry(cur_screen).width()/2)-
       (window_width/2);
     int window_y=
       (QApplication::desktop()->availableGeometry(cur_screen).height()/2)-
       (window_height/2);
     this->setGeometry(window_x,
                       window_y,
                       window_width,
                       window_height);
   }
 
   // Create widgets
   this->p_horizontal_splitter=new QSplitter();
   this->p_horizontal_splitter->setOrientation(Qt::Horizontal);
 
   this->p_node_tree=new RegistryNodeTree(this->p_horizontal_splitter);
 
   this->p_vertical_splitter=new QSplitter(this->p_horizontal_splitter);
   this->p_vertical_splitter->setOrientation(Qt::Vertical);
 
   this->p_key_table=new RegistryKeyTable(this->p_vertical_splitter);
 
   this->p_tab_widget=new TabWidget(this->p_vertical_splitter);
 
   this->p_hex_edit_widget=new HexEditWidget();
   this->p_hex_edit_widget->setEnabled(false);
 
   // Add hexedit page to tab_widget
   this->p_tab_widget->addTab(this->p_hex_edit_widget,tr("Hex viewer"));
 
   // Add widgets to their splitters
   this->p_vertical_splitter->addWidget(this->p_key_table);
   this->p_vertical_splitter->addWidget(this->p_tab_widget);
 
   this->p_horizontal_splitter->addWidget(this->p_node_tree);
   this->p_horizontal_splitter->addWidget(this->p_vertical_splitter);
 
   // Set stretch factors
   QSizePolicy node_tree_policy=this->p_node_tree->sizePolicy();
   node_tree_policy.setHorizontalStretch(1);
   node_tree_policy.setVerticalStretch(100);
   this->p_node_tree->setSizePolicy(node_tree_policy);
 
   QSizePolicy vertical_splitter_policy=this->p_vertical_splitter->sizePolicy();
   vertical_splitter_policy.setHorizontalStretch(4);
   vertical_splitter_policy.setVerticalStretch(100);
   this->p_vertical_splitter->setSizePolicy(vertical_splitter_policy);
 
   QSizePolicy key_table_policy=this->p_key_table->sizePolicy();
   key_table_policy.setVerticalStretch(5);
   key_table_policy.setHorizontalStretch(100);
   this->p_key_table->setSizePolicy(key_table_policy);
 
   QSizePolicy tab_widget_policy=this->p_tab_widget->sizePolicy();
   tab_widget_policy.setVerticalStretch(2);
   tab_widget_policy.setHorizontalStretch(200);
   this->p_tab_widget->setSizePolicy(tab_widget_policy);
 
   // Connect signals
   this->connect(this->p_node_tree,
                 SIGNAL(clicked(QModelIndex)),
                 this,
                 SLOT(SlotNodeTreeClicked(QModelIndex)));
   this->connect(this->p_node_tree,
                 SIGNAL(activated(QModelIndex)),
                 this,
                 SLOT(SlotNodeTreeClicked(QModelIndex)));
   this->connect(this->p_node_tree,
                 SIGNAL(CurrentItemChanged(QModelIndex)),
                 this,
                 SLOT(SlotNodeTreeClicked(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(clicked(QModelIndex)),
                 this,
                 SLOT(SlotKeyTableClicked(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(doubleClicked(QModelIndex)),
                 this,
                 SLOT(SlotKeyTableDoubleClicked(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(CurrentItemChanged(QModelIndex)),
                 this,
                 SLOT(SlotKeyTableClicked(QModelIndex)));
   this->connect(this->p_tab_widget,
                 SIGNAL(tabCloseRequested(int)),
                 this,
                 SLOT(SlotTabCloseButtonClicked(int)));
   this->connect(this->p_node_tree,
                 SIGNAL(SignalAddNode(QModelIndex)),
                 this,
                 SLOT(SlotAddNode(QModelIndex)));
   this->connect(this->p_node_tree,
                 SIGNAL(SignalDeleteNode(QModelIndex)),
                 this,
                 SLOT(SlotDeleteNode(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(SignalAddKey()),
                 this,
                 SLOT(SlotAddKey()));
   this->connect(this->p_key_table,
                 SIGNAL(SignalEditKey(QModelIndex)),
                 this,
                 SLOT(SlotEditKey(QModelIndex)));
   this->connect(this->p_key_table,
                 SIGNAL(SignalDeleteKey(QModelIndex)),
                 this,
                 SLOT(SlotDeleteKey(QModelIndex)));
 
   // Add central widget
   this->setCentralWidget(this->p_horizontal_splitter);
   this->centralWidget()->setContentsMargins(4,4,4,0);
 
   // Set window title
   this->UpdateWindowTitle();
 
   // Create and update recently opened menu
   this->p_recently_opened_menu=new QMenu(this);
   this->ui->ActionRecentlyOpened->setMenu(this->p_recently_opened_menu);
   this->UpdateRecentlyOpenedMenu();
 
   // Update EnableWriteSupport menu according to defaults
   this->UpdateEnableWriteSupportMenu();
 
   // Load report templates
   this->p_reports=new Reports(this->p_settings);
 
   // Finally, react on some command line arguments
   if(this->p_args->IsSet("maximized")) {
     this->setWindowState(Qt::WindowMaximized);
   }
   if(this->p_args->IsSet("fullscreen")) {
     this->setWindowState(Qt::WindowFullScreen);
   }
   if(this->p_args->IsSet("hive-file")) {
     this->OpenHive(this->p_args->GetArgVal("hive-file"));
   }
 }
 
 /*
  * Destructor
  */
 MainWindow::~MainWindow() {
   if(this->is_hive_open) {
     this->p_hive->Close();
   }
 
   // Delete created objects
   delete this->p_reports;
   this->ClearRecentlyOpenedMenu();
   delete this->p_recently_opened_menu;
   delete this->p_hex_edit_widget;
   delete this->p_tab_widget;
   delete this->p_key_table;
   delete this->p_vertical_splitter;
   delete this->p_node_tree;
   delete this->p_horizontal_splitter;
   delete this->p_settings;
   delete this->p_hive;
   delete ui;
 }
 
 /*******************************************************************************
  * Protected
  ******************************************************************************/
 
 /*
  * closeEvent
  */
 void MainWindow::closeEvent(QCloseEvent *p_event) {
   Q_UNUSED(p_event)
 
   // Make sure the user can save any changes
   // TODO: If saving fails, let the user cancel closing
   this->SaveHiveChanges();
 
   // Save window position and size on exit
   this->p_settings->SetWindowGeometry("MainWindow",this->saveGeometry());
   QMainWindow::closeEvent(p_event);
 }
 
 /*******************************************************************************
  * Private slots
  ******************************************************************************/
 
 /*
  * on_action_Open_hive_triggered
  */
 void MainWindow::on_action_Open_hive_triggered() {
   QString hive_file="";
 
   hive_file=QFileDialog::getOpenFileName(this,
                                     tr("Open registry hive"),
                                     this->p_settings->GetLastOpenLocation(),
                                     tr("All files (*)"));
   if(hive_file=="") return;
 
   this->OpenHive(hive_file);
 }
 
 /*
  * on_action_Close_hive_triggered
  */
 void MainWindow::on_action_Close_hive_triggered() {
   // Make sure the user can save any changes
   // TODO: If saving fails, let the user cancel closing
   this->SaveHiveChanges();
 
   if(this->is_hive_open) {
     // Remove search results
     while(this->p_tab_widget->count()>1) {
       this->p_tab_widget->removeTab(this->p_tab_widget->count()-1);
       delete this->search_result_widgets.at(this->p_tab_widget->count()-1);
       this->search_result_widgets.removeLast();
     }
 
     // Delete models
     if(this->p_reg_node_tree_model!=NULL) {
       this->p_node_tree->setModel(NULL);
       delete this->p_reg_node_tree_model_proxy;
       delete this->p_reg_node_tree_model;
       this->p_reg_node_tree_model_proxy=NULL;
       this->p_reg_node_tree_model=NULL;
     }
     if(this->p_reg_key_table_model!=NULL) {
       this->p_key_table->setModel(NULL);
       delete this->p_reg_key_table_model;
       this->p_reg_key_table_model=NULL;
     }
 
     // Remove any data from hex edit and data interpreter
     this->p_hex_edit_widget->SetData(QByteArray());
     this->p_hex_edit_widget->setEnabled(false);
 
     // Close hive
     this->p_hive->Close();
 
     this->is_hive_open=false;
     this->is_hive_writable=!this->p_settings->GetOpenHivesReadOnly();
     this->UpdateWindowTitle();
     this->UpdateMenuStates();
     this->UpdateEnableWriteSupportMenu();
   }
 }
 
 /*
  * on_action_Quit_triggered
  */
 void MainWindow::on_action_Quit_triggered() {
   qApp->exit();
 }
 
 /*
  * on_ActionSearch_triggered
  */
 void MainWindow::on_ActionSearch_triggered() {
   DlgSearch dlg_search(this);
   if(dlg_search.exec()==QDialog::Accepted) {
     // Create search thread and connect needed signals/slots
     this->p_search_thread=new ThreadSearch(this);
 
     // Add new search widget to tabwidget and to internal widget list
     SearchResultWidget *p_search_widget=
       new SearchResultWidget(this->p_tab_widget);
     p_search_widget->setEnabled(false);
     this->search_result_widgets.append(p_search_widget);
 
     this->connect(p_search_widget,
                   SIGNAL(doubleClicked(QModelIndex)),
                   this,
                   SLOT(SlotSearchResultWidgetDoubleClicked(QModelIndex)));
 
     this->p_tab_widget->addTab(p_search_widget,tr("Search results"),true);
     this->p_tab_widget->setCurrentIndex(this->p_tab_widget->count()-1);
 
     // Connect search thread to result widget
     this->connect(this->p_search_thread,
                   SIGNAL(SignalFoundMatch(ThreadSearch::eMatchType,
                                           QString,QString,QString)),
                   p_search_widget,
                   SLOT(SlotFoundMatch(ThreadSearch::eMatchType,
                                       QString,QString,QString)));
     this->connect(this->p_search_thread,
                   SIGNAL(finished()),
                   this,
                   SLOT(SlotSearchFinished()));
     this->connect(this->p_search_thread,
                   SIGNAL(finished()),
                   p_search_widget,
                   SLOT(SlotSearchFinished()));
 
     // Start searching
     this->ui->ActionSearch->setEnabled(false);
     p_search_thread->Search(this->p_hive->Filename(),
                             dlg_search.Keywords(),
                             dlg_search.SearchNodeNames(),
                             dlg_search.SearchKeyNames(),
                             dlg_search.SearchKeyValues());
   }
 }
 
 /*
  * on_ActionEnableWriteSupport_triggered
  */
 void MainWindow::on_ActionEnableWriteSupport_triggered() {
   // There might be unsaved changes, give the user the chance to save them
   if(!this->SaveHiveChanges()) return;
 
   // Reopen hive
   // Reopen has read_only as parameter. Thus we need to pass
   // !this->is_hive_writable which is the case when passing
   // this->is_hive_writable as long as we do it before actually changing our
   // internal state.
   if(!this->p_hive->Reopen(this->is_hive_writable)) {
     QMessageBox::critical(this,
                           tr("Error"),
                           tr("Unable to switch write-support: %1")
                             .arg(this->p_hive->GetErrorMsg()));
     return;
   }
 
   // Switch internal state
   this->is_hive_writable=!this->is_hive_writable;
   this->UpdateEnableWriteSupportMenu();
   this->p_node_tree->SetWritable(this->is_hive_writable);
   this->p_key_table->SetWritable(this->is_hive_writable);
   this->UpdateWindowTitle(this->p_hive->Filename());
 }
 
 /*
  * on_ActionPreferences_triggered
  */
 void MainWindow::on_ActionPreferences_triggered() {
   DlgPreferences dlg_preferences(this->p_settings,this);
   dlg_preferences.exec();
   // Update vars, objects and GUI elements which might be affected by the new
   // settings
   this->UpdateRecentlyOpenedMenu();
   this->is_hive_writable=!this->p_settings->GetOpenHivesReadOnly();
   this->UpdateEnableWriteSupportMenu();
   this->p_reports->LoadReportTemplates();
 }
 
 /*
  * on_ActionGenerateReport_triggered
  */
 void MainWindow::on_ActionGenerateReport_triggered() {
   DlgReportChooser dlg_repchooser(this->p_reports,
                                   this->p_hive->HiveTypeToString(
                                     this->p_hive->HiveType()),
                                   this->p_settings,
                                   this);
   if(dlg_repchooser.exec()==QDialog::Accepted) {
     QList<ReportTemplate*> selected_reports;
 
     // Get selected report
     selected_reports=dlg_repchooser.GetSelectedReports();
     if(selected_reports.isEmpty()) return;
 
     // Generate report(s)
     QString report_result="";
     if(this->p_reports->GenerateReport(this->p_hive,
                                        selected_reports,
                                        report_result,
                                        false))
     {
       // Report generation was successfull, show reports
       DlgReportViewer *p_dlg_report_view=new DlgReportViewer(report_result,
                                                              this->p_settings,
                                                              this);
       p_dlg_report_view->exec();
       delete p_dlg_report_view;
     } else {
       // TODO: Inform user
       qDebug()<<"ERROR: "<<report_result;
     }
   }
 }
 
 /*
  * on_ActionReloadReportTemplates_triggered
  */
 void MainWindow::on_ActionReloadReportTemplates_triggered() {
   this->p_reports->LoadReportTemplates();
 }
 
 /*
  * on_actionAbout_Qt_triggered
  */
 void MainWindow::on_actionAbout_Qt_triggered() {
   QMessageBox::aboutQt(this,tr("About Qt"));
 }
 
 /*
  * on_actionAbout_fred_triggered
  */
 void MainWindow::on_actionAbout_fred_triggered() {
   DlgAbout dlg_about(this);
   dlg_about.exec();
 }
 
 /*
  * SlotNodeTreeClicked
  */
 void MainWindow::SlotNodeTreeClicked(QModelIndex index) {
   QString node_path;
 
   if(!index.isValid()) return;
 
   // Map proxy index to tree model index
   index=this->p_reg_node_tree_model_proxy->mapToSource(index);
 
   // Built node path
   node_path=this->p_reg_node_tree_model->GetNodePath(index);
 
   // Create table model and attach it to the table view
   if(this->p_reg_key_table_model!=NULL) {
     // If a previous model was set, delete it and clear hexedit etc...
     this->p_key_table->setModel(NULL);
     delete this->p_reg_key_table_model;
     this->p_hex_edit_widget->SetData(QByteArray());
   }
   this->p_reg_key_table_model=new RegistryKeyTableModel(this->p_hive,node_path);
   this->p_key_table->setModel(this->p_reg_key_table_model,
                               this->is_hive_writable);
   // Set focus back to nodetree to be able to navigate with keyboard
   this->p_node_tree->setFocus();
 }
 
 /*
  * SlotKeyTableClicked
  */
 void MainWindow::SlotKeyTableClicked(QModelIndex index) {
   if(!index.isValid()) return;
 
   this->selected_key_value=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),2),
                                       RegistryKeyTableModel::
                                         AdditionalRoles_GetRawData)
                                           .toByteArray();
   this->p_hex_edit_widget->SetData(this->selected_key_value);
   // Set focus back to nodetree to be able to navigate with keyboard
   this->p_key_table->setFocus();
 }
 
 /*
  * SlotKeyTableDoubleClicked
  */
 void MainWindow::SlotKeyTableDoubleClicked(QModelIndex index) {
   if(!index.isValid()) return;
   if(!this->is_hive_open) return;
 
   if(this->is_hive_writable) this->SlotEditKey(index);
 }
 
 /*
  * SlotSearchFinished
  */
 void MainWindow::SlotSearchFinished() {
   delete this->p_search_thread;
   this->p_search_thread=NULL;
   this->ui->ActionSearch->setEnabled(true);
   // Enable result widget
   this->search_result_widgets.last()->setEnabled(true);
 }
 
 /*
  * SlotSearchResultWidgetDoubleClicked
  */
 void MainWindow::SlotSearchResultWidgetDoubleClicked(QModelIndex index) {
   SearchResultWidget *p_sender;
   QString path;
   QString match_type;
   QString value;
   QString key="";
   int i;
 
   if(!index.isValid()) return;
 
   // Get pointer to sender
   p_sender=(SearchResultWidget*)QObject::sender();
 
   // Get path and matchtype
   path=p_sender->item(index.row(),0)->text();
   match_type=p_sender->item(index.row(),1)->text();
   value=p_sender->item(index.row(),2)->text();
 
   if(match_type==tr("Node name")) {
     // Node name is not part of path. Add it
     if(path=="\\") path.append(value);
     else path.append("\\").append(value);
   } else if(match_type==tr("Key name")) {
     // Key name is stored in value
     key=value;
   } else if(match_type==tr("Key value")) {
     // Key name is part of path. Save and remove it
     QStringList nodes=path.split("\\",QString::SkipEmptyParts);
     key=nodes.at(nodes.count()-1);
     // Remove \<key name> from path
     path.chop(key.length()+1);
   }
 
   // Expand treeview to correct node
   QList<QModelIndex> indexes=
     this->p_reg_node_tree_model->GetIndexListOf(path);
   for(i=0;i<indexes.count();i++) {
     indexes.replace(i,this->p_reg_node_tree_model_proxy->
                         mapFromSource(indexes.at(i)));
     this->p_node_tree->expand(indexes.at(i));
   }
   if(indexes.count()>0) {
     // Scroll to last expanded node, select it and update widgets
     this->p_node_tree->scrollTo(indexes.at(indexes.count()-1),
                                 QAbstractItemView::PositionAtCenter);
     this->p_node_tree->selectionModel()->clear();
     this->p_node_tree->selectionModel()->
       select(indexes.at(indexes.count()-1),
              QItemSelectionModel::ClearAndSelect |
                QItemSelectionModel::Rows |
                QItemSelectionModel::Current);
     this->SlotNodeTreeClicked(indexes.at(indexes.count()-1));
   }
 
   // Select correct key if search matched on keay name / value
   if(key!="") {
     int row=this->p_reg_key_table_model->GetKeyRow(key);
     this->p_key_table->clearSelection();
     this->p_key_table->scrollTo(this->p_reg_key_table_model->index(row,0),
                                 QAbstractItemView::PositionAtCenter);
     this->p_key_table->selectRow(row);
     this->SlotKeyTableClicked(this->p_reg_key_table_model->index(row,0));
   }
 }
 
 /*
  * SlotTabCloseButtonClicked
  */
 void MainWindow::SlotTabCloseButtonClicked(int index) {
   // Delete tab widget and remove tab
   this->p_tab_widget->removeTab(index);
   delete this->search_result_widgets.at(index-1);
   this->search_result_widgets.removeAt(index-1);
 }
 
 /*
  * SlotRecentlyOpenedFileClicked
  */
 void MainWindow::SlotRecentlyOpenedFileClicked(bool checked) {
   Q_UNUSED(checked)
 
   QAction *p_sender=(QAction*)QObject::sender();
   this->OpenHive(p_sender->text());
 }
 
 /*
  * SlotAddNode
  */
 void MainWindow::SlotAddNode(QModelIndex index) {
   QString node_path;
   int new_node_id;
 
   if(!index.isValid()) return;
 
   // Map proxy index to tree model index and get node path
   index=this->p_reg_node_tree_model_proxy->mapToSource(index);
   node_path=this->p_reg_node_tree_model->GetNodePath(index);
 
   // Query user for a node name
   bool ok=false;
   QString node_name=QInputDialog::getText(this,
                                           tr("Add node"),
                                           tr("Please specify a name for the new node"),
                                           QLineEdit::Normal,
                                           QString(),
                                           &ok);
   if(ok) {
     if((new_node_id=this->p_hive->AddNode(node_path,node_name))==0) {
       QMessageBox::critical(this,
                             tr("Error"),
                             tr("Unable to create node '%1\\%2': %3!")
                               .arg(node_path,
                                    node_name,
                                    this->p_hive->GetErrorMsg()));
     } else {
       // Add node to model. We have to pass node_name as Ascii as utf8 names are
       // not supported inside hives!
       QModelIndex new_node_index=
         this->p_reg_node_tree_model->AddNode(this->p_hive,
                                              index,
                                              new_node_id,
                                              node_name.toAscii());
       // Now that node has been added, expand parent and select new node
       this->p_node_tree->expand(
         this->p_reg_node_tree_model_proxy->mapFromSource(index));
       new_node_index=
         this->p_reg_node_tree_model_proxy->mapFromSource(new_node_index);
       this->p_node_tree->scrollTo(new_node_index,
                                   QAbstractItemView::PositionAtCenter);
       this->p_node_tree->selectionModel()->clear();
       this->p_node_tree->selectionModel()->
         select(new_node_index,
                QItemSelectionModel::ClearAndSelect |
                  QItemSelectionModel::Rows |
                  QItemSelectionModel::Current);
       // And finally update key table
       this->SlotNodeTreeClicked(new_node_index);
     }
   }
 }
 
 /*
  * SlotDeleteNode
  */
 void MainWindow::SlotDeleteNode(QModelIndex index) {
   QString node_path;
 
   if(!index.isValid()) return;
 
   // Map proxy index to tree model index and get node path
   index=this->p_reg_node_tree_model_proxy->mapToSource(index);
   node_path=this->p_reg_node_tree_model->GetNodePath(index);
 
   if(QMessageBox::warning(this,
                           tr("Delete node"),
                           tr("Are you sure you want to remove the node '%1' and all of its child nodes?").arg(node_path),
                           QMessageBox::Yes,
                           QMessageBox::No)==QMessageBox::Yes)
   {
     // Remove node from hive
     if(!this->p_hive->DeleteNode(node_path)) {
       QMessageBox::critical(this,
                             tr("Error"),
                             tr("Unable to delete node '%1': %2!")
                               .arg(node_path,this->p_hive->GetErrorMsg()));
       return;
     }
 
     // Remove node from tree model and select nearest node
     QModelIndex next_node_index=this->p_reg_node_tree_model->RemoveNode(index);
     if(next_node_index.isValid()) {
       next_node_index=
         this->p_reg_node_tree_model_proxy->mapFromSource(next_node_index);
       this->p_node_tree->selectionModel()->clear();
       this->p_node_tree->selectionModel()->
         select(next_node_index,
                QItemSelectionModel::ClearAndSelect |
                  QItemSelectionModel::Rows |
                  QItemSelectionModel::Current);
     }
     // And finally update key table
     this->SlotNodeTreeClicked(next_node_index);
   }
 }
 
 /*
  * SlotAddKey
  */
 void MainWindow::SlotAddKey() {
   DlgAddKey dlg_add_key(this);
   if(dlg_add_key.exec()==QDialog::Accepted) {
     // Get selected parent node
     QModelIndex parent_node=this->p_node_tree->currentIndex();
     parent_node=this->p_reg_node_tree_model_proxy->mapToSource(parent_node);
     QString parent_node_path=this->p_reg_node_tree_model->GetNodePath(parent_node);
 
     // Add key
     int new_key=this->p_hive->AddKey(parent_node_path,
                                      dlg_add_key.KeyName(),
                                      dlg_add_key.KeyType(),
                                      dlg_add_key.KeyValue());
     if(new_key==0) {
       QMessageBox::critical(this,
                             tr("Error"),
                             tr("Unable to add key: %1")
                               .arg(this->p_hive->GetErrorMsg()));
       return;
     }
 
     // Add new key to the key table model
     QModelIndex new_key_index=
       this->p_reg_key_table_model->AddKey(this->p_hive,new_key);
     if(new_key_index.isValid()) {
       this->p_key_table->clearSelection();
       this->p_key_table->scrollTo(new_key_index,
                                   QAbstractItemView::PositionAtCenter);
       this->p_key_table->selectRow(new_key_index.row());
     }
     this->SlotKeyTableClicked(new_key_index);
   }
 }
 
 /*
  * SlotEditKey
  */
 void MainWindow::SlotEditKey(QModelIndex index) {
   if(!index.isValid()) return;
 
   // Get current values
   QString key_name=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),
                                               RegistryKeyTableModel::
                                                 ColumnContent_KeyName),
                                       Qt::DisplayRole).toString();
   QString key_value_type=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),
                                               RegistryKeyTableModel::
                                                 ColumnContent_KeyType),
                                       Qt::DisplayRole).toString();
   QByteArray key_value=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),
                                               RegistryKeyTableModel::
                                                 ColumnContent_KeyValue),
                                       RegistryKeyTableModel::
                                         AdditionalRoles_GetRawData).toByteArray();
 
   // Exec update dialog
   DlgAddKey dlg_update_key(this,key_name,key_value_type,key_value);
   if(dlg_update_key.exec()==QDialog::Accepted) {
     // Get selected parent node
     QModelIndex parent_node=this->p_node_tree->currentIndex();
     parent_node=this->p_reg_node_tree_model_proxy->mapToSource(parent_node);
     QString parent_node_path=this->p_reg_node_tree_model->GetNodePath(parent_node);
 
     // Update key
     int new_key=this->p_hive->UpdateKey(parent_node_path,
                                         dlg_update_key.KeyName(),
                                         dlg_update_key.KeyType(),
                                         dlg_update_key.KeyValue());
     if(new_key==0) {
       QMessageBox::critical(this,
                             tr("Error"),
                             tr("Unable to update key: %1")
                               .arg(this->p_hive->GetErrorMsg()));
       return;
     }
 
     // Update key in key table model
     QModelIndex new_key_index=
       this->p_reg_key_table_model->UpdateKey(this->p_hive,new_key);
     this->p_key_table->clearSelection();
     if(new_key_index.isValid()) {
       this->p_key_table->scrollTo(new_key_index,
                                   QAbstractItemView::PositionAtCenter);
       this->p_key_table->selectRow(new_key_index.row());
       // TODO: Update geometry in case data has been added and is now expanding
       // behind the right border
       // Update HexEditWidget
     }
     this->SlotKeyTableClicked(new_key_index);
   }
 }
 
 /*
  * SlotDeleteKey
  */
 void MainWindow::SlotDeleteKey(QModelIndex index) {
   if(!index.isValid()) return;
 
   // Get selected key name
   QString key_name=
     this->p_reg_key_table_model->data(this->p_reg_key_table_model->
                                         index(index.row(),
                                               RegistryKeyTableModel::
                                                 ColumnContent_KeyName),
                                       Qt::DisplayRole).toString();
 
   // Get selected parent node
   QModelIndex parent_node=this->p_node_tree->currentIndex();
   parent_node=this->p_reg_node_tree_model_proxy->mapToSource(parent_node);
   QString parent_node_path=this->p_reg_node_tree_model->GetNodePath(parent_node);
 
   if(QMessageBox::warning(this,
                           tr("Delete key"),
                           tr("Are you sure you want to remove the key '%1\\%2'?")
                             .arg(parent_node_path,key_name),
                           QMessageBox::Yes,
                           QMessageBox::No)==QMessageBox::Yes)
   {
     // Remove key from hive
     if(!this->p_hive->DeleteKey(parent_node_path,key_name)) {
       QMessageBox::critical(this,
                             tr("Error"),
                             tr("Unable to delete key '%1\\%2': %3")
                               .arg(parent_node_path,
                                    key_name,
                                    this->p_hive->GetErrorMsg()));
       return;
     }
     // Remove key from table model and update selection
     QModelIndex new_key_index=this->p_reg_key_table_model->RemoveKey(index);
     this->p_key_table->clearSelection();
     if(new_key_index.isValid()) {
       this->p_key_table->scrollTo(new_key_index,
                                   QAbstractItemView::PositionAtCenter);
       this->p_key_table->selectRow(new_key_index.row());
     }
   }
 }
 
 /*******************************************************************************
  * Private
  ******************************************************************************/
 
 /*
  * OpenHive
  */
 void MainWindow::OpenHive(QString hive_file) {
   // Update last open location
   this->p_settings->SetLastOpenLocation(
     hive_file.left(hive_file.lastIndexOf(QDir::separator())));
 
   // If another hive is currently open, close it
   if(this->is_hive_open) this->on_action_Close_hive_triggered();
 
   // Try to open hive
   if(!this->p_hive->Open(hive_file,!this->is_hive_writable)) {
     QMessageBox::critical(this,
                           tr("Error opening hive file"),
                           tr("Unable to open file '%1'").arg(hive_file));
     return;
   }
 
   // Create tree model & proxy
   this->p_reg_node_tree_model=new RegistryNodeTreeModel(this->p_hive);
   this->p_reg_node_tree_model_proxy=new RegistryNodeTreeModelProxy(this);
   //this->p_reg_node_tree_model_proxy->setDynamicSortFilter(true);
   this->p_reg_node_tree_model_proxy->
     setSourceModel(this->p_reg_node_tree_model);
   this->p_node_tree->setModel(this->p_reg_node_tree_model_proxy,
                               this->is_hive_writable);
 
   this->is_hive_open=true;
 
   // Enable data interpreter
   this->p_hex_edit_widget->setEnabled(true);
 
   // Update window title
   this->UpdateWindowTitle(hive_file);
 
   // Update menu states
   this->UpdateMenuStates();
 
   // Add file to recent list and update recently opened menu
   this->p_settings->AddRecentFile(hive_file);
   this->UpdateRecentlyOpenedMenu();
 }
 
 /*
  * UpdateWindowTitle
  */
 void MainWindow::UpdateWindowTitle(QString filename) {
   if(filename=="") {
     this->setWindowTitle(QString("%1 v%2").arg(APP_TITLE,APP_VERSION));
   } else {
     this->setWindowTitle(QString("%1 v%2 - %3").arg(APP_TITLE,
                                                     APP_VERSION,
                                                     filename.toLocal8Bit()
                                                       .constData()));
     if(!this->is_hive_writable) {
       this->setWindowTitle(this->windowTitle().append(QString(" (%1)")
                                                         .arg(tr("read-only"))));
     }
   }
 }
 
 /*
  * UpdateMenuStates
  */
 void MainWindow::UpdateMenuStates() {
   if(this->is_hive_open) {
     this->ui->action_Close_hive->setEnabled(true);
-    this->ui->ActionEnableWriteSupport->setEnabled(true);
     this->ui->ActionSearch->setEnabled(true);
     this->ui->ActionEnableWriteSupport->setEnabled(true);
     this->ui->ActionGenerateReport->setEnabled(true);
     this->ui->ActionReloadReportTemplates->setEnabled(true);
+    this->UpdateEnableWriteSupportMenu();
   } else {
     this->ui->action_Close_hive->setEnabled(false);
     this->ui->ActionEnableWriteSupport->setEnabled(false);
     this->ui->ActionSearch->setEnabled(false);
     this->ui->ActionEnableWriteSupport->setEnabled(false);
     this->ui->ActionGenerateReport->setEnabled(false);
     this->ui->ActionReloadReportTemplates->setEnabled(false);
   }
 }
 
 /*
  * ClearRecentlyOpenedMenu
  */
 void MainWindow::ClearRecentlyOpenedMenu() {
   QAction *p_action;
 
   // Remove existing menu entries
   QList<QAction*> menu_entries=this->p_recently_opened_menu->actions();
   QListIterator<QAction*> it_me(menu_entries);
   while(it_me.hasNext()) {
     p_action=it_me.next();
     this->p_recently_opened_menu->removeAction(p_action);
     delete p_action;
   }
 }
 
 /*
  * UpdateRecentlyOpenedMenu
  */
 void MainWindow::UpdateRecentlyOpenedMenu() {
   QStringList recent_files=this->p_settings->GetRecentFiles();
   QAction *p_action;
 
   // Remove existing menu entries
   this->ClearRecentlyOpenedMenu();
 
   // If there are no recent files, disable submenu and return
   if(recent_files.isEmpty()) {
     this->ui->ActionRecentlyOpened->setEnabled(false);
     return;
   } else {
     this->ui->ActionRecentlyOpened->setEnabled(true);
   }
 
   // Add recently opened files to menu
   QListIterator<QString> it_rf(recent_files);
   while(it_rf.hasNext()) {
     // Create menu entry
     p_action=new QAction(it_rf.next(),this->p_recently_opened_menu);
     // Connect it to us
     this->connect(p_action,
                   SIGNAL(triggered(bool)),
                   this,
                   SLOT(SlotRecentlyOpenedFileClicked(bool)));
     // Add it to submenu
     this->p_recently_opened_menu->addAction(p_action);
   }
 }
 
 /*
  * UpdateEnableWriteSupportMenu
  */
 void MainWindow::UpdateEnableWriteSupportMenu() {
   if(!this->is_hive_writable) {
     this->ui->ActionEnableWriteSupport->setText(tr("Enable &write support"));
     this->p_node_tree->SetWritable(false);
     this->p_key_table->SetWritable(false);
   } else {
-    this->ui->ActionEnableWriteSupport->setText(tr("Disable &write support"));
+    this->ui->ActionEnableWriteSupport->setEnabled(false);
     this->p_node_tree->SetWritable(true);
     this->p_key_table->SetWritable(true);
   }
 }
 
 /*
  * SaveHiveChanges
  */
 bool MainWindow::SaveHiveChanges() {
   if(!this->is_hive_open) return true;
   if(!this->is_hive_writable) return true;
   if(!this->p_hive->HasChangesToCommit()) return true;
 
   // There are unsaved changes, ask user if we should commit them
   switch(QMessageBox::information(this,
                                   tr("Hive contains unsaved data"),
                                   tr("Do you want to save them now?"),
                                   QMessageBox::Yes,
                                   QMessageBox::No,
                                   QMessageBox::Cancel))
   {
     case QMessageBox::Yes: {
       if(!this->p_hive->CommitChanges()) {
         QMessageBox::critical(this,
                               tr("Saving changes"),
                               tr("Unable to save changes: %1")
                                 .arg(this->p_hive->GetErrorMsg()));
         return false;
       }
       break;
     }
     case QMessageBox::No: {
       // TODO: Discard any changes if we are changing to read-only!
       break;
     }
     default: {
       return false;
     }
   }
   return true;
 }
diff --git a/trunk/registryhive.cpp b/trunk/registryhive.cpp
index f3bacf4..60bc408 100644
--- a/trunk/registryhive.cpp
+++ b/trunk/registryhive.cpp
@@ -1,1343 +1,1359 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #include <QStringList>
 #include <QDateTime>
 #include <stdlib.h>
 #include <stdio.h>
 
 #include <QDebug>
 
 #include "registryhive.h"
 
 #define MACROS_ENDIANNESS
 #include "macros.h"
 
 // TODO: __WORDSIZE is not defined under mingw and I currently have no idea how
 // to identify a 64bit windows
 #ifndef __WORDSIZE
   #define __WORDSIZE 32
 #endif
 
 #if __WORDSIZE == 64
   #define EPOCH_DIFF 0x19DB1DED53E8000
 #else
   #define EPOCH_DIFF 0x19DB1DED53E8000LL
 #endif
 
 /*******************************************************************************
  * Public
  ******************************************************************************/
 
 /*
  * RegistryHive
  */
 RegistryHive::RegistryHive(QObject *p_parent) : QObject(p_parent) {
   this->erro_msg="";
   this->is_error=false;
   this->hive_file="";
   this->p_hive=NULL;
   this->is_hive_open=false;
   this->is_hive_writable=false;
   this->has_changes_to_commit=false;
 }
 
 /*
  * ~RegistryHive
  */
 RegistryHive::~RegistryHive() {
   if(this->is_hive_open) this->Close();
 }
 
 /*
  * Error
  */
 bool RegistryHive::Error() {
   return this->is_error;
 }
 
 /*
  * GetErrorMsg
  */
 QString RegistryHive::GetErrorMsg() {
   QString msg=this->erro_msg;
   this->erro_msg="";
   this->is_error=false;
   return msg;
 }
 
 /*
  * Open
  */
 bool RegistryHive::Open(QString file, bool read_only) {
   if(this->is_hive_open) return false;
 
   // Open hive file
   this->p_hive=hivex_open(file.toAscii().constData(),
                           read_only ? 0 : HIVEX_OPEN_WRITE);
   if(this->p_hive==NULL) return false;
 
   // Set local vars
   this->hive_file=file;
   this->is_hive_open=true;
   this->is_hive_writable=!read_only;
 
   return true;
 }
 
 /*
  * Reopen
  */
 bool RegistryHive::Reopen(bool read_only) {
   if(!this->is_hive_open) return false;
 
   // Close hive first
   if(hivex_close(this->p_hive)!=0) {
     // According to the docs, even if hivex_close fails, it frees all handles.
     // So we consider this fatal and final!
     this->hive_file="";
     this->is_hive_open=false;
     this->is_hive_writable=false;
     this->has_changes_to_commit=false;
     return false;
   }
 
   // Reopen same hive
   this->p_hive=hivex_open(this->hive_file.toAscii().constData(),
                           read_only ? 0 : HIVEX_OPEN_WRITE);
   if(this->p_hive==NULL) {
     this->hive_file="";
     this->is_hive_open=false;
     this->is_hive_writable=false;
     this->has_changes_to_commit=false;
     return false;
   }
 
   // Update local vars
   this->is_hive_writable=!read_only;
   this->has_changes_to_commit=false;
 
   return true;
 }
 
 /*
  * CommitChanges
  */
 bool RegistryHive::CommitChanges() {
   if(!this->is_hive_open || !this->is_hive_writable) return false;
   if(!this->has_changes_to_commit) return true;
 
   // TODO: Maybe it would be more secure to commit changes to a new file and
   // then move it over the original one.
   if(hivex_commit(this->p_hive,NULL,0)!=0) {
     return false;
   }
   return true;
 }
 
 /*
  * Close
  */
 bool RegistryHive::Close() {
   if(this->is_hive_open) {
     // As hivex_close will _ALWAYS_ free the handle, we don't need the following
     // values anymore
     this->hive_file="";
     this->is_hive_open=false;
     this->is_hive_writable=false;
     this->has_changes_to_commit=false;
 
     // Close hive
     if(hivex_close(this->p_hive)!=0) return false;
   }
   return true;
 }
 
 /*
  * Filename
  */
 QString RegistryHive::Filename() {
   if(this->is_hive_open) return this->hive_file;
   return QString();
 }
 
 /*
  * HiveType
  */
 RegistryHive::teHiveType RegistryHive::HiveType() {
   // Check for SYSTEM hive
   if(this->PathExists("\\Select") && this->PathExists("\\MountedDevices"))
     return RegistryHive::eHiveType_SYSTEM;
   // Check for SOFTWARE hive
   if(this->PathExists("\\Microsoft\\Windows\\CurrentVersion") &&
      this->PathExists("\\Microsoft\\Windows NT\\CurrentVersion"))
     return RegistryHive::eHiveType_SOFTWARE;
   // Check for SAM
   if(this->PathExists("SAM\\Domains\\Account\\Users"))
     return RegistryHive::eHiveType_SAM;
   // Check for SECURITY
   if(this->PathExists("\\Policy\\Accounts") &&
      this->PathExists("\\Policy\\PolAdtEv"))
     return RegistryHive::eHiveType_SECURITY;
   // Check for NTUSER.DAT
   if(this->PathExists("\\Software\\Microsoft\\Windows\\CurrentVersion"))
     return RegistryHive::eHiveType_NTUSER;
   // Unknown hive
   return RegistryHive::eHiveType_UNKNOWN;
 }
 
 /*
  * HiveTypeToString
  */
 QString RegistryHive::HiveTypeToString(teHiveType hive_type) {
   switch(hive_type) {
     case RegistryHive::eHiveType_SYSTEM:
       return "SYSTEM";
       break;
     case RegistryHive::eHiveType_SOFTWARE:
       return "SOFTWARE";
       break;
     case RegistryHive::eHiveType_SAM:
       return "SAM";
       break;
     case RegistryHive::eHiveType_SECURITY:
       return "SECURITY";
       break;
     case RegistryHive::eHiveType_NTUSER:
       return "NTUSER";
       break;
     default:
       return "UNKNOWN";
   }
 }
 
 /*
  * HasChangesToCommit
  */
 bool RegistryHive::HasChangesToCommit() {
   return this->has_changes_to_commit;
 }
 
 /*
  * GetNodes
  */
 QMap<QString,int> RegistryHive::GetNodes(QString path) {
   hive_node_h parent_node;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();
 
   // Get and return nodes
   return this->GetNodesHelper(parent_node);
 }
 
 /*
  * GetNodes
  */
 QMap<QString,int> RegistryHive::GetNodes(int parent_node) {
   if(parent_node==0) {
     this->SetError(tr("Invalid parent node handle specified!"));
     return QMap<QString,int>();
   }
 
   // Get and return nodes
   return this->GetNodesHelper(parent_node);
 }
 
 /*
  * GetKeys
  */
 QMap<QString,int> RegistryHive::GetKeys(QString path) {
   hive_node_h parent_node;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();
 
   // Get and return keys
   return this->GetKeysHelper(parent_node);
 }
 
 /*
  * GetKeys
  */
 QMap<QString,int> RegistryHive::GetKeys(int parent_node) {
   if(parent_node==0) {
     this->SetError(tr("Invalid parent node handle specified!"));
     return QMap<QString,int>();
   }
 
   // Get and return keys
   return this->GetKeysHelper(parent_node);
 }
 
 /*
  * GetKeyName
  */
 bool RegistryHive::GetKeyName(int hive_key, QString &key_name) {
   char *buf;
 
   if(!this->is_hive_open) {
     this->SetError(tr("Need to operate on an open hive!"));
     return false;
   }
 
   buf=hivex_value_key(this->p_hive,(hive_value_h)hive_key);
   if(buf==NULL) {
     this->SetError(tr("Unable to get key name for key '%1'").arg(hive_key));
     return false;
   }
 
   key_name=QString(buf);
   free(buf);
 
   return true;
 }
 
 /*
  * GetKeyValue
  */
 QByteArray RegistryHive::GetKeyValue(QString path,
                                      QString key,
                                      int *p_value_type,
                                      size_t *p_value_len)
 {
   hive_node_h parent_node;
   hive_value_h hive_key;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&parent_node)) return QByteArray();
 
   // Get key handle
   hive_key=hivex_node_get_value(this->p_hive,
                                 parent_node,key.toAscii().constData());
   if(hive_key==0) {
     this->SetError(tr("Unable to get key handle!"));
     *p_value_len=-1;
     return QByteArray();
   }
 
   // Get and return key value
   return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
 }
 
 /*
  * GetKeyValue
  */
 QByteArray RegistryHive::GetKeyValue(int hive_key,
                                      int *p_value_type,
                                      size_t *p_value_len)
 {
   if(hive_key==0) {
     this->SetError(tr("Invalid key handle specified!"));
     *p_value_type=-1;
     return QByteArray();
   }
 
   // Get and return key value
   return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
 }
 
 /*
  * GetKeyModTime
  */
 int64_t RegistryHive::GetNodeModTime(QString path) {
   hive_node_h node;
 
   // Get handle to last node in path
   if(!this->GetNodeHandle(path,&node)) {
     this->SetError(tr("Unable to get node handle!"));
     return 0;
   }
 
   // Get and return node's last modification timestamp
   return this->GetNodeModTime(node);
 }
 
 /*
  * GetKeyModTime
  */
 int64_t RegistryHive::GetNodeModTime(int node) {
   if(node==0) {
     this->SetError(tr("Invalid node handle specified!"));
     return 0;
   }
 
   // Get and return key's last modification timestamp
   return hivex_node_timestamp(this->p_hive,node);
 }
 
 /*
  * KeyValueToString
  */
 QString RegistryHive::KeyValueToString(QByteArray value, int value_type) {
   QString ret="";
-  int i=0;
 
-  #define ToHexStr() {                                                      \
-    for(i=0;i<value.size();i++) {                                           \
-    ret.append(QString().sprintf("%02X ",(uint8_t)(value.constData()[i]))); \
-    }                                                                       \
-    ret.chop(1);                                                            \
+  #define ToHexStr() {                                                        \
+    for(int i=0;i<value.size();i++) {                                         \
+      ret.append(QString().sprintf("%02X ",(uint8_t)(value.constData()[i]))); \
+    }                                                                         \
+    ret.chop(1);                                                              \
   }
 
+  // Convert value according to it's type
   switch(value_type) {
-    case hive_t_REG_NONE:
-      // Just a key without a value, but to be certain...
-      ToHexStr();
-      break;
     case hive_t_REG_SZ:
-      // A Windows string (encoding is unknown, but often UTF16-LE)
-      // TODO: What happens if encoding is not UTF16-LE ??? Thx Billy!!!
-      ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
-      break;
     case hive_t_REG_EXPAND_SZ:
-      // A Windows string (encoding is unknown, but often UTF16-LE) that may
-      // contain %env% (environment variable expansion) elements
-      // TODO: What happens if encoding is not UTF16-LE ??? Thx Billy!!!
-      ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
+      // A Windows string (REG_SZ), or a Windows string containing %env%
+      // (environment variable expansion) elements (REG_EXPAND_SZ).
+      // Encoding is unknown, but often UTF16-LE (isn't this great?)
+      // Try to detect ANSI vs UNICODE encoding
+      if(value.size()==0) {
+        ret=QString();
+      } else if(value.size()>=2 && value.endsWith(QByteArray("\x00\x00",2))) {
+        // Seems to be a unicode string, convert to host endianness and return
+        // TODO: What if it is UTF16-BE?? Thx Billy!
+        QByteArray buf=value;
+        UTF16LETOH(buf.data(),buf.size());
+        ret=QString().fromUtf16((ushort*)(buf.constData()));
+      } else if(value.endsWith(QByteArray("\x00",1))) {
+        // Seems to be an ansi string
+        ret=QString().fromAscii((char*)value.constData());
+      } else {
+        // If we can't detect encoding, return string as hex
+        ToHexStr();
+      }
       break;
-    case hive_t_REG_BINARY:
-      // A blob of binary
-      ToHexStr();
+    case hive_t_REG_MULTI_SZ:
+      // Multiple Windows strings.
+      // I suppose this is always LE encoded! M$ devs really suck!
+      ret=RegistryHive::KeyValueToStringList(value).join("\n");
       break;
     case hive_t_REG_DWORD:
       // DWORD (32 bit integer), little endian
       ret=QString().sprintf("0x%08X",LE32TOH(*(uint32_t*)value.constData()));
       break;
     case hive_t_REG_DWORD_BIG_ENDIAN:
       // DWORD (32 bit integer), big endian
       ret=QString().sprintf("0x%08X",BE32TOH(*(uint32_t*)value.constData()));
       break;
-    case hive_t_REG_LINK:
-      // Symbolic link to another part of the registry tree
-      ToHexStr();
-      break;
-    case hive_t_REG_MULTI_SZ:
-      // Multiple Windows strings.
-      // I suppose this is always LE encoded! M$ devs really suck!
-      ret=RegistryHive::KeyValueToStringList(value).join("\n");
-      break;
-    case hive_t_REG_RESOURCE_LIST:
-      // Resource list
-      ToHexStr();
-      break;
-    case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
-      // Resource descriptor
-      ToHexStr();
-      break;
-    case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
-      // Resouce requirements list
-      ToHexStr();
-      break;
     case hive_t_REG_QWORD:
-      // QWORD (64 bit integer). Usually little endian.
+      // QWORD (64 bit integer). Usually little endian (grrrr).
       ret=
         QString("0x%1").arg((quint64)LE64TOH(*(uint64_t*)value.constData()),
                             16,
                             16,
                             QChar('0'));
       break;
+    case hive_t_REG_NONE:
+    case hive_t_REG_BINARY:
+    case hive_t_REG_LINK:
+    case hive_t_REG_RESOURCE_LIST:
+    case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
+    case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
     default:
+      // A key without a value (REG_NONE), a blob of binary (REG_BINARY), a
+      // symbolic link to another part of the registry tree (REG_LINK), a
+      // resource list (REG_RESOURCE_LIST), a resource descriptor
+      // (FULL_RESOURCE_DESCRIPTOR), a resource requirements list
+      // (REG_RESOURCE_REQUIREMENTS_LIST) or something unknown.
+      // All these are converted to hex.
       ToHexStr();
   }
 
   #undef ToHexStr
 
   return ret;
 }
 
 /*
  * KeyValueToString
  */
 QString RegistryHive::KeyValueToString(QByteArray key_value,
                                        QString format,
                                        int offset,
                                        int length,
                                        bool little_endian)
 {
   int remaining_data_len;
   const char *p_data;
   QString ret="";
 
   // Calculate how many bytes are remainig after specified offset
   remaining_data_len=key_value.size()-offset;
   if(!remaining_data_len>0) {
     // Nothing to show
     return QString();
   }
 
   // Get pointer to data at specified offset
   p_data=key_value.constData();
   p_data+=offset;
 
   // Convert value
   if(format=="int8" && remaining_data_len>=1) {
     ret=QString().sprintf("%d",*(int8_t*)p_data);
   } else if(format=="uint8" && remaining_data_len>=1) {
     ret=QString().sprintf("%u",*(uint8_t*)p_data);
   } else if(format=="int16" && remaining_data_len>=2) {
     int16_t val;
     if(little_endian) val=LE16TOH(*(int16_t*)p_data);
     else val=BE16TOH(*(int16_t*)p_data);
     ret=QString().sprintf("%d",val);
   } else if(format=="uint16" && remaining_data_len>=2) {
     uint16_t val;
     if(little_endian) val=LE16TOH(*(uint16_t*)p_data);
     else val=BE16TOH(*(uint16_t*)p_data);
     ret=QString().sprintf("%u",val);
   } else if(format=="int32" && remaining_data_len>=4) {
     int32_t val;
     if(little_endian) val=LE32TOH(*(int32_t*)p_data);
     else val=BE32TOH(*(int32_t*)p_data);
     ret=QString().sprintf("%d",val);
   } else if(format=="uint32" && remaining_data_len>=4) {
     uint32_t val;
     if(little_endian) val=LE32TOH(*(uint32_t*)p_data);
     else val=BE32TOH(*(uint32_t*)p_data);
     ret=QString().sprintf("%u",val);
   } else if(format=="unixtime" && remaining_data_len>=4) {
     uint32_t val;
     if(little_endian) val=LE32TOH(*(uint32_t*)p_data);
     else val=BE32TOH(*(uint32_t*)p_data);
     if(val==0) {
       ret="n/a";
     } else {
       QDateTime date_time;
       date_time.setTimeSpec(Qt::UTC);
       date_time.setTime_t(val);
       ret=date_time.toString("yyyy/MM/dd hh:mm:ss");
     }
   } else if(format=="int64" && remaining_data_len>=8) {
     int64_t val;
     if(little_endian) val=LE64TOH(*(int64_t*)p_data);
     else val=BE64TOH(*(int64_t*)p_data);
     ret=QString("%1").arg(val);
   } else if(format=="uint64" && remaining_data_len>=8) {
     uint64_t val;
     if(little_endian) val=LE64TOH(*(uint64_t*)p_data);
     else val=BE64TOH(*(uint64_t*)p_data);
     ret=QString("%1").arg(val);
 /*
   // TODO: Check how one could implement this
   } else if(format=="unixtime64" && remaining_data_len>=8) {
     if(*(uint64_t*)p_data==0) {
       ret="n/a";
     } else {
       uint64_t secs=*(uint64_t*)p_data;
       QDateTime date_time;
       date_time.setTimeSpec(Qt::UTC);
       // Set 32bit part of date/time
       date_time.setTime_t(secs&0xFFFFFFFF);
       // Now add high 32bit part of date/time
       date_time.addSecs(secs>>32);
       ret=date_time.toString("yyyy/MM/dd hh:mm:ss");
     }
 */
   } else if(format=="filetime" && remaining_data_len>=8) {
     uint64_t val;
     if(little_endian) val=LE64TOH(*(uint64_t*)p_data);
     else val=BE64TOH(*(uint64_t*)p_data);
     if(val==0) {
       ret="n/a";
     } else {
       // TODO: Warn if >32bit
       QDateTime date_time;
       date_time.setTimeSpec(Qt::UTC);
       date_time.setTime_t(RegistryHive::FiletimeToUnixtime(val));
       ret=date_time.toString("yyyy/MM/dd hh:mm:ss");
     }
   } else if(format=="ascii") {
     if(length!=-1) {
       // User specified how many bytes to convert
       ret=QString().fromAscii((char*)p_data,length);
     } else {
       // User did not specify how many bytes to convert, make sure data is 0
       // terminated
       if(key_value.indexOf("\x00",offset)!=-1) {
         // Data is 0 terminated
         ret=QString().fromAscii((char*)p_data);
       } else {
         // Data is not 0 terminated, convert all remaining_data_len bytes
         ret=QString().fromAscii((char*)p_data,remaining_data_len);
       }
     }
   } else if(format=="utf16" && remaining_data_len>=2) {
+    QByteArray buf;
     if(length!=-1) {
       // User specified how many bytes to convert
-      ret=QString().fromUtf16((ushort*)p_data,length);
+      buf=key_value.mid(offset,(length%2)==0 ? length : length-1);
+      buf.append("\x00\x00",2);
     } else {
       // User did not specify how many bytes to convert, make sure data is
       // double 0 terminated
-      if(key_value.indexOf(QByteArray("\x00\x00",2),offset)!=-1) {
+      int null_offset=RegistryHive::FindUnicodeStringEnd(key_value.mid(offset));
+      if(null_offset!=-1) {
         // Data is double 0 terminated
-        ret=QString().fromUtf16((ushort*)p_data);
+        buf=key_value.mid(offset,null_offset+2);
       } else {
         // Data is not double 0 terminated, convert all remaining_data_len bytes
-        ret=QString().fromUtf16((ushort*)p_data,remaining_data_len);
+        buf=key_value.mid(offset,
+                          (remaining_data_len%2)==0 ?
+                            remaining_data_len : remaining_data_len-1);
+        buf.append("\x00\x00",2);
       }
     }
+    // Convert from requested endianness to host
+    if(little_endian) {
+      UTF16LETOH(buf.data(),buf.size());
+    } else {
+      UTF16BETOH(buf.data(),buf.size());
+    }
+    ret=QString().fromUtf16((ushort*)buf.constData());
   } else {
     // Unknown variant type or another error
+    // TODO: Maybe return an error
     return QString();
   }
 
   return ret;
 }
 
 /*
  * KeyValueToStringList
  *
  * Should only be used for REG_MULTI_SZ values
  */
 QStringList RegistryHive::KeyValueToStringList(QByteArray value,
                                                bool little_endian,
                                                bool *p_ansi_encoded)
 {
   // Try to find value encoding (ANSI vs UNICODE)
   bool is_ansi;
   if(value.size()<=2) {
     // http://blogs.msdn.com/b/oldnewthing/archive/2009/10/08/9904646.aspx
     // Ansi version of a REG_MULTI_SZ needs to be terminated by 2 \0 chars.
     // So as long as the byte array has less or equal to 2 chars, it must be
     // empty.
     return QStringList();
   } else if(value.size()==3) {
     // Only 3 chars, this can only be an ansi string consisting of 1 char and 2
     // \0 to terminate it
     return QStringList()
       <<QString(QChar((char)*((uint8_t*)(value.constData()))));
   } else if(value.size()==4) {
     if((uint32_t)*((uint32_t*)(value.constData()))==0) {
       // http://blogs.msdn.com/b/oldnewthing/archive/2009/10/08/9904646.aspx
       // Unicode version of a REG_MULTI_SZ needs to be terminated by 4 \0 chars.
       // So as long as the byte array has less or equal to 4 chars, and they are
       // all 0 it must be empty.
       return QStringList();
     } else {
       // Must be the ansi version of REG_MULTI_SZ
       is_ansi=true;
     }
   } else if((uint32_t)*((uint32_t*)(value.right(4).constData()))==0) {
-    // Value end with 4 \0 chars, it must be unicode
+    // Value ends with 4 \0 chars, it must be unicode
     is_ansi=false;
   } else if((uint32_t)*((uint32_t*)(value.right(3).constData()))==0) {
-    // Value end with 3 \0 chars. Not possible according to the specs, but
+    // Value ends with 3 \0 chars. Not possible according to the specs, but
     // already seen in values M$ is storing! Those were unicode.
     is_ansi=false;
   } else if((uint16_t)*((uint16_t*)(value.right(2).constData()))==0) {
-    // Value only end with 2 \0 chars, it must be ansi
+    // Value only ends with 2 \0 chars, it must be ansi
     is_ansi=true;
   } else {
     // Value has more than 4 chars but does not end in 2 or 4 \0 chars. This
     // is not according to specs!
     return QStringList();
   }
 
   // Convert value to string list
   QStringList result=QStringList();
   QByteArray buf;
   int last_pos=0,cur_pos=0;
   if(!is_ansi) {
     // Extract unicode strings
     while(last_pos<value.size() &&
-          (cur_pos=value.indexOf(QByteArray("\x00\x00",2),last_pos))!=-1)
+          (cur_pos=RegistryHive::FindUnicodeStringEnd(value,last_pos))!=-1)
     {
       if(cur_pos==last_pos) break;
-      buf=value.mid(last_pos,(cur_pos-last_pos)+3);
+      buf=value.mid(last_pos,(cur_pos-last_pos)+2);
       if(little_endian) {
         // Convert from LE to host
-        for(int i=0;i<buf.size();i+=2) {
-          *((uint16_t*)(buf.data()+i))=LE16TOH(*((uint16_t*)(buf.data()+i)));
-        }
+        UTF16LETOH(buf.data(),buf.size());
       } else {
         // Convert from BE to host
-        for(int i=0;i<buf.size();i+=2) {
-          *((uint16_t*)(buf.data()+i))=BE16TOH(*((uint16_t*)(buf.data()+i)));
-        }
+        UTF16BETOH(buf.data(),buf.size());
       }
       result.append(QString().fromUtf16((ushort*)buf.constData()));
-      last_pos=cur_pos+3;
+      last_pos=cur_pos+2;
     }
   } else {
     // Extract ansi strings
     while(last_pos<value.count() &&
           (cur_pos=value.indexOf(QByteArray("\x00",1),last_pos))!=-1)
     {
       if(cur_pos==last_pos) break;
       result.append(QString().fromLocal8Bit(value.mid(last_pos,
                                                       (cur_pos-last_pos)+1)
                                             .constData()));
       last_pos=cur_pos+1;
     }
   }
 
   if(p_ansi_encoded!=NULL) *p_ansi_encoded=is_ansi;
   return result;
 }
 
 /*
  * StringListToKeyValue
  */
 QByteArray RegistryHive::StringListToKeyValue(QStringList strings,
                                               bool little_endian,
                                               bool ansi_encoded)
 {
   // Return empty key value if there are no strings
   if(strings.count()==0) {
     if(ansi_encoded) return QByteArray("\x00\x00",2);
     else return QByteArray("\x00\x00\x00\x00",4);
   }
 
   // Convert string list
   QByteArray result=QByteArray();
   QString cur_string;
   QByteArray buf;
   QListIterator<QString> strings_it(strings);
   while(strings_it.hasNext()) {
     cur_string=strings_it.next();
     if(ansi_encoded) {
       // Ansi encoding, simply append char string and terminating \0
       result.append(cur_string.toAscii().constData(),cur_string.size());
       result.append("\x00",1);
     } else {
       // Unicode encoding
       // First, convert value to utf16
       // TODO: May fail if there is a char that needs more than 16 bit
       buf=QByteArray((char*)(cur_string.utf16()),cur_string.size()*2);
       // Then convert to correct endianness
       if(little_endian) {
-        for(int i=0;i<buf.size();i+=2) {
-          *((uint16_t*)(buf.data()+i))=HTOLE16(*((uint16_t*)(buf.data()+i)));
-        }
+        HTOUTF16LE(buf.data(),buf.size());
       } else {
-        for(int i=0;i<buf.size();i+=2) {
-          *((uint16_t*)(buf.data()+i))=HTOBE16(*((uint16_t*)(buf.data()+i)));
-        }
+        HTOUTF16BE(buf.data(),buf.size());
       }
       // And finally append converted value and terminating \0\0 to result
       result.append(buf);
       result.append("\x00\x00",2);
     }
   }
 
   // Append terminating \0 chars and return
   if(ansi_encoded) result.append("\x00",1);
   else result.append("\x00\x00",2);
   return result;
 }
 
 /*
  * GetKeyValueTypes
  */
 QStringList RegistryHive::GetKeyValueTypes() {
   return QStringList()<<"REG_NONE"
                         <<"REG_SZ"
                         <<"REG_EXPAND_SZ"
                         <<"REG_BINARY"
                         <<"REG_DWORD"
                         <<"REG_DWORD_BIG_ENDIAN"
                         <<"REG_LINK"
                         <<"REG_MULTI_SZ"
                         <<"REG_RESOURCE_LIST"
                         <<"REG_FULL_RESOURCE_DESC"
                         <<"REG_RESOURCE_REQ_LIST"
                         <<"REG_QWORD";
 }
 
 /*
  * KeyTypeToString
  */
 QString RegistryHive::KeyValueTypeToString(int value_type) {
   QString ret="";
 
   switch(value_type) {
     case hive_t_REG_NONE:
       ret="REG_NONE";
       break;
     case hive_t_REG_SZ:
       ret="REG_SZ";
       break;
     case hive_t_REG_EXPAND_SZ:
       ret="REG_EXPAND_SZ";
       break;
     case hive_t_REG_BINARY:
       ret="REG_BINARY";
       break;
     case hive_t_REG_DWORD:
       ret="REG_DWORD";
       break;
     case hive_t_REG_DWORD_BIG_ENDIAN:
       ret="REG_DWORD_BIG_ENDIAN";
       break;
     case hive_t_REG_LINK:
       ret="REG_LINK";
       break;
     case hive_t_REG_MULTI_SZ:
       ret="REG_MULTI_SZ";
       break;
     case hive_t_REG_RESOURCE_LIST:
       ret="REG_RESOURCE_LIST";
       break;
     case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
       ret="REG_FULL_RESOURCE_DESC";
       break;
     case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
       ret="REG_RESOURCE_REQ_LIST";
       break;
     case hive_t_REG_QWORD:
       ret="REG_QWORD";
       break;
     default:
       ret=QString().sprintf("0x%08X",(uint32_t)value_type);
   }
 
   return ret;
 }
 
 /*
  * StringToKeyValueType
  */
 int RegistryHive::StringToKeyValueType(QString value_type) {
   if(value_type=="REG_NONE") return hive_t_REG_NONE;
   if(value_type=="REG_SZ") return hive_t_REG_SZ;
   if(value_type=="REG_EXPAND_SZ") return hive_t_REG_EXPAND_SZ;
   if(value_type=="REG_BINARY") return hive_t_REG_BINARY;
   if(value_type=="REG_DWORD") return hive_t_REG_DWORD;
   if(value_type=="REG_DWORD_BIG_ENDIAN") return hive_t_REG_DWORD_BIG_ENDIAN;
   if(value_type=="REG_LINK") return hive_t_REG_LINK;
   if(value_type=="REG_MULTI_SZ") return hive_t_REG_MULTI_SZ;
   if(value_type=="REG_RESOURCE_LIST") return hive_t_REG_RESOURCE_LIST;
   if(value_type=="REG_FULL_RESOURCE_DESC")
     return hive_t_REG_FULL_RESOURCE_DESCRIPTOR;
   if(value_type=="REG_RESOURCE_REQ_LIST")
     return hive_t_REG_RESOURCE_REQUIREMENTS_LIST;
   if(value_type=="REG_QWORD") return hive_t_REG_QWORD;
 
   // I think this might be a good default :-)
   return hive_t_REG_BINARY;
 }
 
 /*
  * FiletimeToUnixtime
  */
 uint64_t RegistryHive::FiletimeToUnixtime(int64_t filetime) {
   return (unsigned)((filetime-EPOCH_DIFF)/10000000);
 }
 
 /*
  * AddNode
  */
 int RegistryHive::AddNode(QString parent_node_path, QString node_name) {
   if(!this->is_hive_writable) return 0;
 
   // Make sure name does not contain a backslash char
   if(node_name.contains('\\')) {
     this->SetError(tr("Unable to add node with name '%1'. "
                         "Names can not include a backslash character.")
                      .arg(node_name));
     return 0;
   }
 
   // Get node handle to the parent where the new node should be created
   hive_node_h parent_node;
   if(!this->GetNodeHandle(parent_node_path,&parent_node)) {
     this->SetError(tr("Unable to get node handle for '%1'!")
                      .arg(parent_node_path));
     return 0;
   }
 
   // Make sure there is no other node with same name
   QMap<QString,int> child_nodes=this->GetNodes(parent_node);
   if(child_nodes.contains(node_name.toAscii())) {
     this->SetError(tr("The node '%1\\%2' already exists!")
                      .arg(parent_node_path,node_name));
     return 0;
   }
 
   // Add new node
   hive_node_h new_node=hivex_node_add_child(this->p_hive,
                                             parent_node,
                                             node_name.toAscii().constData());
   if(new_node==0) {
     this->SetError(tr("Unable to create new node '%1\\%2'!")
                      .arg(parent_node_path,node_name));
     return 0;
   }
 
   this->has_changes_to_commit=true;
   return new_node;
 }
 
 /*
  * DeleteNode
  */
 bool RegistryHive::DeleteNode(QString node_path) {
   if(!this->is_hive_writable) return false;
 
   // Get node handle to the node that should be deleted
   hive_node_h node;
   if(!this->GetNodeHandle(node_path,&node)) {
     this->SetError(tr("Unable to get node handle for '%1'!")
                      .arg(node_path));
     return false;
   }
 
   // Delete node
   if(hivex_node_delete_child(this->p_hive,node)==-1) {
     this->SetError(tr("Unable to delete node '%1'!")
                      .arg(node_path));
     return false;
   }
 
   this->has_changes_to_commit=true;
   return true;
 }
 
 /*
  * AddKey
  */
 int RegistryHive::AddKey(QString parent_node_path,
                          QString key_name,
                          QString key_value_type,
                          QByteArray key_value)
 {
   if(!this->is_hive_open || !this->is_hive_writable) {
     this->SetError(tr("Hive has not been opened or opened read-only!"));
     return false;
   }
 
   return this->SetKey(parent_node_path,
                       key_name,
                       key_value_type,
                       key_value,
                       true);
 }
 
 /*
  * UpdateKey
  */
 int RegistryHive::UpdateKey(QString parent_node_path,
                             QString key_name,
                             QString key_value_type,
                             QByteArray key_value)
 {
   if(!this->is_hive_open || !this->is_hive_writable) {
     this->SetError(tr("Hive has not been opened or opened read-only!"));
     return false;
   }
 
   return this->SetKey(parent_node_path,
                       key_name,
                       key_value_type,
                       key_value,
                       false);
 }
 
 /*
  * DeleteKey
  */
 bool RegistryHive::DeleteKey(QString parent_node_path, QString key_name) {
   if(!this->is_hive_open || !this->is_hive_writable) {
     this->SetError(tr("Hive has not been opened or opened read-only!"));
     return false;
   }
 
   // libhivex offers no possibility to delete a single key :-(
   // As a work around, this function temporarly stores all keys of the specified
   // node, then deletes them all an re-creates all but the one that should be
   // deleted.
 
   // Get handle to parent node
   hive_node_h parent_node;
   if(!this->GetNodeHandle(parent_node_path,&parent_node)) {
     return false;
   }
 
   // Get all child keys
   hive_value_h *p_keys=hivex_node_values(this->p_hive,parent_node);
   if(p_keys==NULL) {
     this->SetError(tr("Unable to enumerate child keys for parent '%1'!")
                      .arg(parent_node_path));
     return false;
   }
 
   // Get all child key values except the one that should be deleted
   int i=0;
   char *p_name;
   int node_keys_count=0;
   hive_set_value *node_keys=NULL;
 
 #define FREE_NODE_KEYS() {             \
   for(int x=0;x<node_keys_count;x++) { \
     free(node_keys[x].key);            \
     free(node_keys[x].value);          \
   }                                    \
   free(node_keys);                     \
 }
 
   while(p_keys[i]) {
     p_name=hivex_value_key(this->p_hive,p_keys[i]);
     if(p_name==NULL) {
       this->SetError(tr("Unable to get key name for a child of '%1'!")
                        .arg(parent_node_path));
       return false;
     }
     if(QString(p_name)!=key_name) {
       // Current key is not the one that should be deleted, save it
       // Alloc mem for new hive_set_value struct in node_keys array
       node_keys=(hive_set_value*)realloc(node_keys,
                                          sizeof(hive_set_value)*
                                            (node_keys_count+1));
       if(node_keys==NULL) {
         this->SetError(tr("Unable to alloc enough memory for all child keys!"));
         return false;
       }
       // Save key name in hive_set_value struct
       node_keys[node_keys_count].key=p_name;
       // Get key value, key value type and key value len and save to
       // hive_set_value struct
       node_keys[node_keys_count].value=
         hivex_value_value(this->p_hive,
                           p_keys[i],
                           &(node_keys[node_keys_count].t),
                           &(node_keys[node_keys_count].len));
       if(node_keys[node_keys_count].value==NULL) {
         this->SetError(tr("Unable to get value for key '%1'!").arg(p_name));
         free(p_name);
         // Free all temporary stored keys
         FREE_NODE_KEYS();
         return false;
       }
       node_keys_count++;
     } else {
       // Current key is to be deleted, ignore it
       free(p_name);
     }
     i++;
   }
 
   // Save all stored keys to hive, which will discard the one that should be
   // deleted
   if(hivex_node_set_values(this->p_hive,
                            parent_node,
                            node_keys_count,
                            node_keys,
                            0)!=0)
   {
     this->SetError(tr("Unable to re-save all child keys! Please discard any "
                       "changes you made and start over. No doing so might end "
                       "in data loss!"));
     // Free all temporary stored keys
     FREE_NODE_KEYS();
     return false;
   }
 
   // Free all temporary stored keys and return
   FREE_NODE_KEYS();
 
 #undef FREE_NODE_KEYS
 
   this->has_changes_to_commit=true;
   return true;
 }
 
 /*******************************************************************************
  * Private
  ******************************************************************************/
 
 /*
  * HivexError2String
  */
 QString RegistryHive::HivexError2String(int error) {
   switch(error) {
     case ENOTSUP:
       return QString("Corrupt or unsupported Registry file format.");
       break;
     case HIVEX_NO_KEY:
       return QString("Missing root key.");
       break;
     case EINVAL:
       return QString("Passed an invalid argument to the function.");
       break;
     case EFAULT:
       return QString("Followed a Registry pointer which goes outside the "
                        "registry or outside a registry block.");
       break;
     case ELOOP:
       return QString("Registry contains cycles.");
       break;
     case ERANGE:
       return QString("Field in the registry out of range.");
       break;
     case EEXIST:
       return QString("Registry key already exists.");
       break;
     case EROFS:
       return QString("Tried to write to a registry which is not opened for "
                        "writing.");
       break;
     default:
       return QString("Unknown error.");
   }
 }
 
 /*
  * SetError
  */
 void RegistryHive::SetError(QString msg) {
   this->erro_msg=msg;
   this->is_error=true;
 }
 
 /*
  * GetNodeHandle
  */
 bool RegistryHive::GetNodeHandle(QString &path, hive_node_h *p_node) {
   QStringList nodes;
   int i=0;
 
   // Get root node handle
   *p_node=hivex_root(this->p_hive);
   if(*p_node==0) {
     this->SetError(tr("Unable to get root node!"));
     return false;
   }
 
   if(path!="\\") {
     // If we aren't listing the root node, we have to get a handle to the
     // last node in the path. Split path into nodes
     nodes=path.split('\\',QString::SkipEmptyParts);
 
     // Iterate to the correct parent node
     for(i=0;i<nodes.count();i++) {
       *p_node=hivex_node_get_child(this->p_hive,
                                    *p_node,
                                    nodes.value(i).toAscii().constData());
       if(*p_node==0) {
         this->SetError(tr("Unable to find node '%1'!").arg(nodes.value(i)));
         return false;
       }
     }
   }
 
   return true;
 }
 
 /*
  * GetKeyHandle
  */
 bool RegistryHive::GetKeyHandle(QString &parent_node_path,
                                 QString &key_name,
                                 hive_value_h *p_key)
 {
   // Get handle to parent node
   hive_node_h parent_node;
   if(!this->GetNodeHandle(parent_node_path,&parent_node)) {
     return false;
   }
 
   // Get handle to key
   *p_key=hivex_node_get_value(this->p_hive,
                               parent_node,
                               key_name.toAscii().constData());
   if(*p_key==0) {
     this->SetError(tr("Unable to get handle to key '%1\\%2'!")
                      .arg(parent_node_path,key_name));
     return false;
   }
 
   return true;
 }
 
 /*
  * GetNodesHelper
  */
 QMap<QString,int> RegistryHive::GetNodesHelper(hive_node_h parent_node) {
   QMap<QString,int> keys;
   char *p_name;
   int i=0;
 
   // Get child nodes
   hive_node_h *child_nodes=hivex_node_children(this->p_hive,parent_node);
   if(child_nodes==NULL) {
     this->SetError(
       tr("Unable to enumerate child nodes!"));
     return QMap<QString,int>();
   }
 
   // Build result
   keys.clear();
   i=0;
   while(child_nodes[i]) {
     p_name=hivex_node_name(this->p_hive,child_nodes[i]);
     if(p_name==NULL) {
       this->SetError(tr("Unable to get node name!"));
       free(child_nodes);
       return QMap<QString,int>();
     }
     keys.insert(QString(p_name),(int)child_nodes[i]);
     free(p_name);
     i++;
   }
   free(child_nodes);
 
   return keys;
 }
 
 /*
  * GetKeysHelper
  */
 QMap<QString,int> RegistryHive::GetKeysHelper(hive_node_h parent_node) {
   QMap<QString,int> keys;
   char *p_name;
   int i=0;
 
   // Get child keys
   hive_value_h *p_keys=hivex_node_values(this->p_hive,parent_node);
   if(p_keys==NULL) {
     this->SetError(
       tr("Unable to enumerate child keys!"));
     return QMap<QString,int>();
   }
 
   // Build result list
   keys.clear();
   i=0;
 
   while(p_keys[i]) {
     p_name=hivex_value_key(this->p_hive,p_keys[i]);
     if(p_name==NULL) {
       this->SetError(tr("Unable to get key name!"));
       return QMap<QString,int>();
     }
     keys.insert(QString(p_name),p_keys[i]);
     free(p_name);
     i++;
   }
   free(p_keys);
 
   return keys;
 }
 
 /*
  * GetKeyValueHelper
  */
 QByteArray RegistryHive::GetKeyValueHelper(hive_value_h hive_key,
                                            int *p_value_type,
                                            size_t *p_value_len)
 {
   QByteArray key_value;
   char *p_key_value;
 
   p_key_value=hivex_value_value(this->p_hive,
                                 hive_key,
                                 (hive_type*)p_value_type,
                                 p_value_len);
   if(p_key_value==NULL) {
     this->SetError(tr("Unable to get key value!"));
     *p_value_type=-1;
     return QByteArray();
   }
 
   // Feed QByteArray and free p_key_value
   key_value=QByteArray(p_key_value,*p_value_len);
   free(p_key_value);
 
   return key_value;
 }
 
 /*
  * PathExists
  */
 bool RegistryHive::PathExists(QString path) {
   bool ret;
   hive_node_h node;
 
   ret=this->GetNodeHandle(path,&node);
   if(!ret || this->Error()) {
     // Clear error and return false
     this->GetErrorMsg();
     return false;
   }
 
   return true;
 }
 
 /*
  * SetKey
  */
 int RegistryHive::SetKey(QString &parent_node_path,
                          QString &key_name,
                          QString &key_value_type,
                          QByteArray &key_value,
                          bool create_key)
 {
   // Get node handle to the node that holds the key to create/update
   hive_node_h parent_node;
   if(!this->GetNodeHandle(parent_node_path,&parent_node)) {
     return 0;
   }
 
   // Make sure key exists if we should update it
   if(!create_key) {
     hive_value_h temp_key=hivex_node_get_value(this->p_hive,
                                                parent_node,
                                                key_name.toAscii().constData());
     if(temp_key==0) {
       this->SetError(tr("Inexisting key '%1\\%2' can't be updated!")
                        .arg(parent_node_path,key_name));
       return 0;
     }
   }
 
   // Create and populate hive_set_value structure
   hive_set_value key_val;
   key_val.key=(char*)malloc((sizeof(char)*key_name.toAscii().count())+1);
   key_val.value=(char*)malloc(sizeof(char)*key_value.size());
   if(key_val.key==NULL || key_val.value==NULL) {
     this->SetError(tr("Unable to alloc memory for hive_set_value struct!"));
     return 0;
   }
   strcpy(key_val.key,key_name.toAscii().constData());
   key_val.t=(hive_type)this->StringToKeyValueType(key_value_type);
   key_val.len=key_value.size();
   memcpy(key_val.value,key_value.constData(),key_value.size());
 
   // Create/Update key
   if(hivex_node_set_value(this->p_hive,parent_node,&key_val,0)!=0) {
     this->SetError(tr("Unable to update key '%1\\%2'!")
                      .arg(parent_node_path,key_name));
     return 0;
   }
 
   // Free the hive_set_value structure
   free(key_val.key);
   free(key_val.value);
 
   // To make sure everything worked, a hadle to the new key is now requeried
   // from hive and then returned
   hive_value_h key;
   if(!this->GetKeyHandle(parent_node_path,key_name,&key)) {
     return 0;
   }
 
   this->has_changes_to_commit=true;
   return key;
 }
+
+/*
+ * FindUnicodeStringEnd
+ */
+int RegistryHive::FindUnicodeStringEnd(QByteArray data, int offset) {
+  int end_pos;
+  for(end_pos=offset;end_pos<(data.size()-1);end_pos+=2) {
+    if(*((uint16_t*)(data.constData()+end_pos))==0) break;
+  }
+  return end_pos<(data.size()-1) ? end_pos : -1;
+}
diff --git a/trunk/registryhive.h b/trunk/registryhive.h
index b9a319b..b782a03 100644
--- a/trunk/registryhive.h
+++ b/trunk/registryhive.h
@@ -1,131 +1,132 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #ifndef REGISTRYHIVE_H
 #define REGISTRYHIVE_H
 
 #include <QObject>
 #include <QMap>
 
 #include <hivex.h>
 
 class RegistryHive : public QObject {
   Q_OBJECT
 
   public:
     typedef enum eHiveType {
       eHiveType_UNKNOWN=0,
       eHiveType_SYSTEM,
       eHiveType_SOFTWARE,
       eHiveType_SAM,
       eHiveType_SECURITY,
       eHiveType_NTUSER
     } teHiveType;
 
     explicit RegistryHive(QObject *p_parent=0);
     ~RegistryHive();
 
     bool Error();
     QString GetErrorMsg();
 
     bool Open(QString file, bool read_only=true);
     bool Reopen(bool read_only=true);
     bool CommitChanges();
     bool Close();
 
     QString Filename();
     teHiveType HiveType();
     QString HiveTypeToString(teHiveType hive_type);
     bool HasChangesToCommit();
 
     QMap<QString,int> GetNodes(QString path="\\");
     QMap<QString,int> GetNodes(int parent_node=0);
     QMap<QString,int> GetKeys(QString path="\\");
     QMap<QString,int> GetKeys(int parent_node=0);
     bool GetKeyName(int hive_key, QString &key_name);
     QByteArray GetKeyValue(QString path,
                            QString key,
                            int *p_value_type,
                            size_t *p_value_len);
     QByteArray GetKeyValue(int hive_key,
                            int *p_value_type,
                            size_t *p_value_len);
     int64_t GetNodeModTime(QString path);
     int64_t GetNodeModTime(int node);
     static QString KeyValueToString(QByteArray value, int value_type);
     static QString KeyValueToString(QByteArray value,
                                     QString format,
                                     int offset=0,
                                     int length=-1,
                                     bool little_endian=true);
     static QStringList KeyValueToStringList(QByteArray value,
                                             bool little_endian=true,
                                             bool *p_ansi_encoded=NULL);
     static QByteArray StringListToKeyValue(QStringList strings,
                                            bool little_endian=true,
                                            bool ansi_encoded=false);
     static QStringList GetKeyValueTypes();
     static QString KeyValueTypeToString(int value_type);
     static int StringToKeyValueType(QString value_type);
     static uint64_t FiletimeToUnixtime(int64_t filetime);
 
     int AddNode(QString parent_node_path, QString node_name);
     bool DeleteNode(QString node_path);
 
     int AddKey(QString parent_node_path,
                QString key_name,
                QString key_value_type,
                QByteArray key_value);
     int UpdateKey(QString parent_node_path,
                   QString key_name,
                   QString key_value_type,
                   QByteArray key_value);
     bool DeleteKey(QString parent_node_path, QString key_name);
 
   private:
     QString erro_msg;
     bool is_error;
     QString hive_file;
     hive_h *p_hive;
     bool is_hive_open;
     bool is_hive_writable;
     bool has_changes_to_commit;
 
     QString HivexError2String(int error);
     void SetError(QString msg);
     bool GetNodeHandle(QString &path, hive_node_h *p_node);
     bool GetKeyHandle(QString &parent_node_path,
                       QString &key_name,
                       hive_value_h *p_key);
     QMap<QString,int> GetNodesHelper(hive_node_h parent_node);
     QMap<QString,int> GetKeysHelper(hive_node_h parent_node);
     QByteArray GetKeyValueHelper(hive_value_h hive_key,
                                  int *p_value_type,
                                  size_t *p_value_len);
     bool PathExists(QString path);
     int SetKey(QString &parent_node_path,
                QString &key_name,
                QString &key_value_type,
                QByteArray &key_value,
                bool create_key);
+    static int FindUnicodeStringEnd(QByteArray data, int offset=0);
 
 };
 
 #endif // REGISTRYHIVE_H
diff --git a/trunk/registrykeytable.cpp b/trunk/registrykeytable.cpp
index d01cfe5..a15e7b8 100644
--- a/trunk/registrykeytable.cpp
+++ b/trunk/registrykeytable.cpp
@@ -1,211 +1,213 @@
 /*******************************************************************************
 * fred Copyright (c) 2011-2013 by Gillen Daniel <gillen.dan@pinguin.lu>        *
 *                                                                              *
 * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor  *
 * with special feautures useful during forensic analysis.                      *
 *                                                                              *
 * This program is free software: you can redistribute it and/or modify it      *
 * under the terms of the GNU General Public License as published by the Free   *
 * Software Foundation, either version 3 of the License, or (at your option)    *
 * any later version.                                                           *
 *                                                                              *
 * This program is distributed in the hope that it will be useful, but WITHOUT  *
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or        *
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for     *
 * more details.                                                                *
 *                                                                              *
 * You should have received a copy of the GNU General Public License along with *
 * this program. If not, see <http://www.gnu.org/licenses/>.                    *
 *******************************************************************************/
 
 #include "registrykeytable.h"
 
 #include <QHeaderView>
 #include <QApplication>
 #include <QClipboard>
 
 /*******************************************************************************
  * Public
  ******************************************************************************/
 
 RegistryKeyTable::RegistryKeyTable(QWidget *p_parent) : QTableView(p_parent) {
   this->is_writable=false;
 
   // Configure widget
   this->setSelectionMode(QAbstractItemView::SingleSelection);
   this->setSelectionBehavior(QAbstractItemView::SelectRows);
   this->setAutoScroll(false);
   this->setHorizontalScrollMode(QAbstractItemView::ScrollPerPixel);
   this->verticalHeader()->setHidden(true);
   this->setTextElideMode(Qt::ElideNone);
 
   // Create context menu item
   this->p_action_add_key=new QAction(tr("Add new key"),this);
   this->p_action_edit_key=new QAction(tr("Edit selected key"),this);
   this->p_action_delete_key=new QAction(tr("Delete selected key"),this);
   this->p_menu_copy=new QMenu(tr("Copy"),this);
   this->p_action_copy_key_name=
     new QAction(tr("Selected key name"),this->p_menu_copy);
   this->p_menu_copy->addAction(this->p_action_copy_key_name);
   this->p_action_copy_key_value=
     new QAction(tr("Selected key value"),this->p_menu_copy);
   this->p_menu_copy->addAction(this->p_action_copy_key_value);
 
   // Connect context menu signals
   this->connect(this->p_action_add_key,
                 SIGNAL(triggered()),
                 this,
                 SLOT(SlotAddKey()));
   this->connect(this->p_action_edit_key,
                 SIGNAL(triggered()),
                 this,
                 SLOT(SlotEditKey()));
   this->connect(this->p_action_delete_key,
                 SIGNAL(triggered()),
                 this,
                 SLOT(SlotDeleteKey()));
   this->connect(this->p_action_copy_key_name,
                 SIGNAL(triggered()),
                 this,
                 SLOT(SlotCopyKeyName()));
   this->connect(this->p_action_copy_key_value,
                 SIGNAL(triggered()),
                 this,
                 SLOT(SlotCopyKeyValue()));
 }
 
 RegistryKeyTable::~RegistryKeyTable() {
   // Delete context menu
   delete this->p_action_copy_key_name;
   delete this->p_action_copy_key_value;
   delete this->p_menu_copy;
   delete this->p_action_delete_key;
   delete this->p_action_edit_key;
   delete this->p_action_add_key;
 }
 
 void RegistryKeyTable::setModel(QAbstractItemModel *p_model, bool writable) {
   QTableView::setModel(p_model);
   // Resize table rows / columns to fit data
   this->resizeColumnsToContents();
   this->resizeRowsToContents();
   this->horizontalHeader()->stretchLastSection();
   if(p_model!=NULL && p_model->rowCount()>0) {
     // Select first table item
     this->selectRow(0);
   }
 
   // Set writable status
   this->SetWritable(writable);
 }
 
 void RegistryKeyTable::SetWritable(bool writable) {
   this->is_writable=writable;
   this->p_action_add_key->setEnabled(this->is_writable);
   this->p_action_edit_key->setEnabled(this->is_writable);
   this->p_action_delete_key->setEnabled(this->is_writable);
 }
 
 /*
 void RegistryKeyTable::selectRow(QString key_name) {
   int i;
 
   this->clearSelection();
   for(i=0;i<this->model()->rowCount();i++) {
     if(this->model())
   }
 }
 */
 
 /*******************************************************************************
  * Protected
  ******************************************************************************/
 
 int RegistryKeyTable::sizeHintForColumn(int column) const {
   int size_hint=-1;
   int i=0;
   int item_width=0;
   QFontMetrics fm(this->fontMetrics());
   QModelIndex idx;
 
   if(this->model()==NULL) return -1;
 
   // Find string that needs the most amount of space
   idx=this->model()->index(i,column);
   while(idx.isValid()) {
     item_width=fm.width(this->model()->data(idx).toString())+10;
     if(item_width>size_hint) size_hint=item_width;
     idx=this->model()->index(++i,column);
   }
 
   return size_hint;
 }
 
 void RegistryKeyTable::contextMenuEvent(QContextMenuEvent *p_event) {
   // Only show context menu if a hive is open (a model was set)
   if(this->model()==NULL) return;
 
   // Decide what menus should be enabled
   if(this->selectedIndexes().count()==3) {
     // A row is selected, enable full context menu
-    this->p_action_edit_key->setEnabled(true);
-    this->p_action_delete_key->setEnabled(true);
+    this->p_action_add_key->setEnabled(this->is_writable);
+    this->p_action_edit_key->setEnabled(this->is_writable);
+    this->p_action_delete_key->setEnabled(this->is_writable);
     this->p_menu_copy->setEnabled(true);
   } else {
     // No row is selected, disable all menu items except AddKey
+    this->p_action_add_key->setEnabled(this->is_writable);
     this->p_action_edit_key->setEnabled(false);
     this->p_action_delete_key->setEnabled(false);
     this->p_menu_copy->setEnabled(false);
   }
 
   // Emit clicked signal (makes sure item under cursor is selected if it wasn't)
   emit(this->clicked(this->indexAt(p_event->pos())));
 
   // Create context menu, add actions and show it
   QMenu context_menu(this);
   context_menu.addAction(this->p_action_add_key);
   context_menu.addAction(this->p_action_edit_key);
   context_menu.addAction(this->p_action_delete_key);
   context_menu.addSeparator();
   context_menu.addMenu(this->p_menu_copy);
   context_menu.exec(p_event->globalPos());
 }
 
 void RegistryKeyTable::currentChanged(const QModelIndex &current,
                                       const QModelIndex &previous)
 {
   // Call parent class's currentChanged first
   QTableView::currentChanged(current,previous);
 
   // Now emit our signal
   QModelIndex current_item=QModelIndex(current);
   emit(RegistryKeyTable::CurrentItemChanged(current_item));
 }
 
 /*******************************************************************************
  * Private slots
  ******************************************************************************/
 
 void RegistryKeyTable::SlotAddKey() {
   emit(this->SignalAddKey());
 }
 
 void RegistryKeyTable::SlotEditKey() {
   emit(this->SignalEditKey(this->selectedIndexes().at(0)));
 }
 
 void RegistryKeyTable::SlotDeleteKey() {
   emit(this->SignalDeleteKey(this->selectedIndexes().at(0)));
 }
 
 void RegistryKeyTable::SlotCopyKeyName() {
   QApplication::clipboard()->
     setText(this->selectedIndexes().at(0).data().toString(),
             QClipboard::Clipboard);
 }
 
 void RegistryKeyTable::SlotCopyKeyValue() {
   QApplication::clipboard()->
     setText(this->selectedIndexes().at(2).data().toString(),
             QClipboard::Clipboard);
 }
diff --git a/trunk/report_templates/NTUSER_Autoruns.qs b/trunk/report_templates/NTUSER_Autoruns.qs
index f0a40a0..e67797c 100644
--- a/trunk/report_templates/NTUSER_Autoruns.qs
+++ b/trunk/report_templates/NTUSER_Autoruns.qs
@@ -1,61 +1,56 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Autoruns",
             report_author : "Gillen Daniel",
             report_desc   : "Dump autorun keys",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function ListAutoruns(autorun_path,autorun_key) {
   println("  <p style=\"font-size:12; white-space:nowrap\">");
   println("    <u>"+autorun_key+"</u><br />");
   var run_keys=GetRegistryKeys(autorun_path+autorun_key);
   if(IsValid(run_keys) && run_keys.length>0) {
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
     print_table_row("<b>Name</b>","<b>Executable</b>");
 
     for(var i=0;i<run_keys.length;i++) {
       var val=GetRegistryKeyValue(autorun_path+autorun_key,run_keys[i]);
       print_table_row(run_keys[i],RegistryKeyValueToString(val.value,val.type));
     }
     
     println("    </table>");
   } else {
     println("    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;None");
   }
   println("  </p>");
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>User Autoruns</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>User Autoruns</h2>");
 
   // Run
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","Run");
 
   // RunOnce
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnce");
 
   // RunOnceEx
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnceEx");
 
   // TODO: There might be a Run under WindowsNT\CurrentVersion\Run too!
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/NTUSER_LaunchedApplications.qs b/trunk/report_templates/NTUSER_LaunchedApplications.qs
index 1e4bb61..346296f 100644
--- a/trunk/report_templates/NTUSER_LaunchedApplications.qs
+++ b/trunk/report_templates/NTUSER_LaunchedApplications.qs
@@ -1,111 +1,108 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Launched applications",
             report_author : "Gillen Daniel",
             report_desc   : "Dump IE launched applications",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function PrintTableRow(cell01,cell02,cell03) {
   println("      <tr><td style=\"white-space:nowrap\">",cell01,"</td><td style=\"padding:2px; white-space:nowrap\">",cell02,"</td><td style=\"padding:2px; white-space:nowrap\">",cell03,"</td></tr>");
 }
 
 function Rot13Decode(val) {
   var ret="";
 
   for(var i=0;i<val.length;i++) {
     var decoded=val.charCodeAt(i);
     if((decoded>64 && decoded<91) || (decoded>96 && decoded<123)) {
       if((decoded-13)<65 || (decoded>96 && (decoded-13)<97)) {
         decoded=(decoded-13)+26;
       } else {
         if(decoded>96 && (decoded-13)<97) {
           decoded+=13;
         } else {
           decoded-=13;
         }
       }
       ret+=String.fromCharCode(decoded);
     } else {
       ret+=val[i];
     }
   }
 
   return ret;
 }
 
 function PrintUserAssistEntry(key,val,os) {
   var run_count;
   var last_run;
 
   switch(os) {
     case "winxp":
       run_count=RegistryKeyValueToVariant(val.value,"uint32",4);
 
       break;
     case "win7":
       run_count=RegistryKeyValueToVariant(val.value,"uint32",4,0,1);
       last_run=RegistryKeyValueToVariant(val.value,"filetime",60);
       break;
   }
 
   PrintTableRow(key,run_count,last_run);
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Launched Applications</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Launched applications</h2>");
 
   // First, we need to find the correct GUID for the current Windows version
   var path;
   var apps;
   var os;
 
   // Windows XP
   os="winxp";
   path="\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{5E6AB780-7743-11CF-A12B-00AA004AE837}\\Count";
   apps=GetRegistryKeys(path);
 
   // TODO: Determine GUIDs for Vista / Win8
 
   if(!IsValid(apps)) {
     // Windows 7
     os="win7";
     path="\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count";
     apps=GetRegistryKeys(path);
   }
 
   if(IsValid(apps)) {
     if(apps.length!=0) {
       println("  <p style=\"font-size:12\">");
       println("    <table style=\"margin-left:20px; font-size:12\">");
       println("      <tr><td><b>Application</b></td><td style=\"padding:2px\"><b>Run count</b></td><td style=\"padding:2px\"><b>Last run</b></td></tr>");
 
       for(var i=0;i<apps.length;i++) {
         var val=GetRegistryKeyValue(path,apps[i]);
         PrintUserAssistEntry(Rot13Decode(apps[i]),val,os);
       }
 
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    The list of launched applications is empty.");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of launched applications!");
     println("  </font></p>");
   }
 }
diff --git a/trunk/report_templates/NTUSER_RecentDocs.qs b/trunk/report_templates/NTUSER_RecentDocs.qs
index 32228fe..bd8b2fa 100644
--- a/trunk/report_templates/NTUSER_RecentDocs.qs
+++ b/trunk/report_templates/NTUSER_RecentDocs.qs
@@ -1,54 +1,49 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Recent documents",
             report_author : "Gillen Daniel",
             report_desc   : "Dump recent docs",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Recent Documents</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Recent documents</h2>");
 
   // Get list of recent docs
   var recent_docs=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs","MRUListEx");
   if(IsValid(recent_docs)) {
     // Iterate over all recent docs
     var i=0;
     var runlist=RegistryKeyValueToVariant(recent_docs.value,"uint32",i);
     if(Number(runlist)!=0xffffffff) {
       println("  <p style=\"font-size:12\">");
       println("    <table style=\"margin-left:20px; font-size:12\">");
 
       while(Number(runlist)!=0xffffffff) {
         var entry=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs",runlist.toString(10));
         println("      <tr><td style=\"white-space:nowrap\">",RegistryKeyValueToVariant(entry.value,"utf16",0),"</td></tr>");
         i+=4;
         runlist=RegistryKeyValueToVariant(recent_docs.value,"uint32",i);
       }
 
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    The list of recent documents is empty.");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of recent documents!");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/NTUSER_TypedUrls.qs b/trunk/report_templates/NTUSER_TypedUrls.qs
index f5c4e1c..d8465c7 100644
--- a/trunk/report_templates/NTUSER_TypedUrls.qs
+++ b/trunk/report_templates/NTUSER_TypedUrls.qs
@@ -1,49 +1,44 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Typed URLs",
             report_author : "Gillen Daniel",
             report_desc   : "Dump typed URLs",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Typed Urls</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Typed urls</h2>");
 
   // Iterate over all typed urls
   var typed_urls=GetRegistryKeys("\\Software\\Microsoft\\Internet Explorer\\TypedURLs");
   if(IsValid(typed_urls)) {
     if(typed_urls.length!=0) {
       println("  <p style=\"font-size:12\">");
       println("    <table style=\"margin-left:20px; font-size:12\">");
 
       for(var i=0;i<typed_urls.length;i++) {
         var val=GetRegistryKeyValue("\\Software\\Microsoft\\Internet Explorer\\TypedURLs",typed_urls[i]);
         println("      <tr><td style=\"white-space:nowrap\">",RegistryKeyValueToString(val.value,val.type),"</td></tr>");
       }
 
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    The list of typed urls is empty.");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of typed urls!");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/NTUSER_Windows7_SearchKeywords.qs b/trunk/report_templates/NTUSER_Windows7_SearchKeywords.qs
index fe97c28..b4afed4 100644
--- a/trunk/report_templates/NTUSER_Windows7_SearchKeywords.qs
+++ b/trunk/report_templates/NTUSER_Windows7_SearchKeywords.qs
@@ -1,54 +1,49 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Windows 7 search keywords",
             report_author : "Gillen Daniel",
             report_desc   : "Dump Windows 7 search keywords",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Document And Folder Search Keywords</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Document and folder search keywords</h2>");
 
   // Get list of search keys
   var mrulist=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery","MRUListEx");
   if(IsValid(mrulist)) {
     // Iterate over all items
     var i=0;
     var runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i);
     if(Number(runlist)!=0xffffffff) {
       println("  <p style=\"font-size:12\">");
       println("    <table style=\"margin-left:20px; font-size:12\">");
 
       while(Number(runlist)!=0xffffffff) {
         var entry=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery",runlist.toString(10));
         println("      <tr><td style=\"white-space:nowrap\">",RegistryKeyValueToVariant(entry.value,"utf16",0),"</td></tr>");
         i+=4;
         runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i);
       }
 
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    The list of document and search keywords is empty.");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of document and folder search keywords!");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/NTUSER_Windows7_TypedPaths.qs b/trunk/report_templates/NTUSER_Windows7_TypedPaths.qs
index 947a9c6..96ccb20 100644
--- a/trunk/report_templates/NTUSER_Windows7_TypedPaths.qs
+++ b/trunk/report_templates/NTUSER_Windows7_TypedPaths.qs
@@ -1,49 +1,44 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Windows 7 typed paths",
             report_author : "Gillen Daniel",
             report_desc   : "Dump Windows 7 typed paths",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Typed Paths</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Typed paths</h2>");
 
   // Iterate over all typed paths
   var urls=GetRegistryKeys("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths");
   if(IsValid(urls)) {
     if(urls.length!=0) {
       println("  <p style=\"font-size:12\">");
       println("    <table style=\"margin-left:20px; font-size:12\">");
 
       for(var i=0;i<urls.length;i++) {
         var val=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths",urls[i]);
         println("      <tr><td style=\"white-space:nowrap\">",RegistryKeyValueToString(val.value,val.type),"</td></tr>");
       }
 
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    The list of typed paths is empty.");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of typed paths!");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/NTUSER_WindowsLiveAccounts.qs b/trunk/report_templates/NTUSER_WindowsLiveAccounts.qs
index c52547b..5c48bd1 100644
--- a/trunk/report_templates/NTUSER_WindowsLiveAccounts.qs
+++ b/trunk/report_templates/NTUSER_WindowsLiveAccounts.qs
@@ -1,48 +1,43 @@
 function fred_report_info() {
   var info={report_cat    : "NTUSER",
             report_name   : "Windows Live accounts",
             report_author : "Gillen Daniel",
             report_desc   : "Dump Windows Live accounts",
             fred_api      : 2,
             hive          : "NTUSER"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Windows Live Accounts</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Windows live accounts</h2>");
 
   // Iterate over all contacts
   var accounts=GetRegistryKeys("\\Software\\Microsoft\\Windows Live Contacts\\Database");
   if(IsValid(accounts)) {
     println("  <p style=\"font-size:12\">");
     println("    <table style=\"margin-left:20px; font-size:12\">");
 
     for(var i=0;i<accounts.length;i++) {
       var val=GetRegistryKeyValue("\\Software\\Microsoft\\Windows Live Contacts\\Database",accounts[i]);
       println("      <tr><td>",accounts[i],"</td><td>",RegistryKeyValueToString(val.value,val.type),"</td></tr>");
     }
     accounts=GetRegistryKeys("\\Software\\Microsoft\\Windows Live Contacts\\Me");
     for(var i=0;i<accounts.length;i++) {
       var val=GetRegistryKeyValue("\\Software\\Microsoft\\Windows Live Contacts\\Me",accounts[i]);
       println("      <tr><td>",accounts[i],"</td><td>",RegistryKeyValueToString(val.value,val.type),"</td></tr>");
     }
 
     println("    </table>");
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    This registry hive does not contain a list of Windows Live Accounts!");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SAM_UserAccounts.qs b/trunk/report_templates/SAM_UserAccounts.qs
index f3ee71c..6eb2770 100644
--- a/trunk/report_templates/SAM_UserAccounts.qs
+++ b/trunk/report_templates/SAM_UserAccounts.qs
@@ -1,109 +1,104 @@
 function fred_report_info() {
   var info={report_cat    : "SAM",
             report_name   : "User accounts",
             report_author : "Gillen Daniel",
             report_desc   : "Dump Windows user accounts",
             fred_api      : 2,
             hive          : "SAM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function print_v_info(v_key_value,info_name,str_off) {
   var offset=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off))+0x0cc;
   var len=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off+4))/2;
   if(len>0) print_table_row(info_name,RegistryKeyValueToVariant(v_key_value,"utf16",offset,len));
 }
 
 function fred_report_html() {
   // See http://windowsir.blogspot.com/2006/08/getting-user-info-from-image.html
-//  println("<html>");
-//  println("  <head><title>User Accounts</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>User accounts</h2>");
 
   // Iterate over all user names
   var user_names=GetRegistryNodes("\\SAM\\Domains\\Account\\Users\\Names");
   if(IsValid(user_names)) {
     for(var i=0;i<user_names.length;i++) {
       println("  <p style=\"font-size:12; white-space:nowrap\">");
 
       // Print user name
       println("    <u>",user_names[i],"</u><br />");
 
       println("    <table style=\"margin-left:20px; font-size:12\">");
 
       // Get user rid stored in "default" key
       var user_rid=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\Names\\",user_names[i]),"");
       user_rid=RegistryKeyTypeToString(user_rid.type);
       println("      <tr><td>RID:</td><td>",Number(user_rid).toString(10)," (",user_rid,")","</td></tr>");
 
       // RegistryKeyTypeToString returns the rid prepended with "0x". We have to remove that for further processing
       user_rid=String(user_rid).substr(2);
 
       // Get user's V key and print various infos
       var v_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"V");
       print_v_info(v_key.value,"Full name:",0x18);
       print_v_info(v_key.value,"Comment:",0x24);
       print_v_info(v_key.value,"Home directory:",0x48);
       print_v_info(v_key.value,"Home directory drive:",0x54);
       print_v_info(v_key.value,"Logon script path:",0x60);
       print_v_info(v_key.value,"Profile path:",0x6c);
 
       // Get user's F key and print various infos
       var f_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"F");
       print_table_row("Last login time:",RegistryKeyValueToVariant(f_key.value,"filetime",8));
       print_table_row("Last pw change:",RegistryKeyValueToVariant(f_key.value,"filetime",24));
       print_table_row("Last failed login:",RegistryKeyValueToVariant(f_key.value,"filetime",40));
       print_table_row("Account expires:",RegistryKeyValueToVariant(f_key.value,"filetime",32));
       print_table_row("Total logins:",RegistryKeyValueToVariant(f_key.value,"uint16",66));
       print_table_row("Failed logins:",RegistryKeyValueToVariant(f_key.value,"uint16",64));
       var acc_flags=Number(RegistryKeyValueToVariant(f_key.value,"uint16",56));
       print("      <tr><td>Account flags:</td><td>");
       if(acc_flags&0x0001) print("Disabled ");
       if(acc_flags&0x0002) print("HomeDirReq ");
       if(acc_flags&0x0004) print("PwNotReq ");
       if(acc_flags&0x0008) print("TempDupAcc ");
       // I don't think this would be useful to show
       //if(acc_flags&0x0010) print("NormUserAcc ");
       if(acc_flags&0x0020) print("MnsAcc ");
       if(acc_flags&0x0040) print("DomTrustAcc ");
       if(acc_flags&0x0080) print("WksTrustAcc ");
       if(acc_flags&0x0100) print("SrvTrustAcc ");
       if(acc_flags&0x0200) print("NoPwExpiry ");
       if(acc_flags&0x0400) print("AccAutoLock ");
       print(" (",acc_flags,")");
       println("</td></tr>");
 
       // Get password hint if available
       var hint=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"UserPasswordHint");
       if(typeof hint !== 'undefined') {
         // Append missing trailing utf16 zero byte
         hint.value.appendByte(0);
         hint.value.appendByte(0);
         print_table_row("Password hint:",RegistryKeyValueToVariant(hint.value,"utf16"));
       }
 
       // TODO: User group membership
 
       println("  </table>");
       println("  </p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    Unable to enumerate users!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SOFTWARE_Autoruns.qs b/trunk/report_templates/SOFTWARE_Autoruns.qs
index d335d70..053e63d 100644
--- a/trunk/report_templates/SOFTWARE_Autoruns.qs
+++ b/trunk/report_templates/SOFTWARE_Autoruns.qs
@@ -1,61 +1,56 @@
 function fred_report_info() {
   var info={report_cat    : "SOFTWARE",
             report_name   : "Autoruns",
             report_author : "Gillen Daniel",
             report_desc   : "Dump autoruns",
             fred_api      : 2,
             hive          : "SOFTWARE"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function ListAutoruns(autorun_path,autorun_key) {
   println("  <p style=\"font-size:12; white-space:nowrap\">");
   println("    <u>"+autorun_key+"</u><br />");
   var run_keys=GetRegistryKeys(autorun_path+autorun_key);
   if(IsValid(run_keys) && run_keys.length>0) {
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
     print_table_row("<b>Name</b>","<b>Executable</b>");
 
     for(var i=0;i<run_keys.length;i++) {
       var val=GetRegistryKeyValue(autorun_path+autorun_key,run_keys[i]);
       print_table_row(run_keys[i],RegistryKeyValueToString(val.value,val.type));
     }
     
     println("    </table>");
   } else {
     println("    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;None");
   }
   println("  </p>");
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>System Autoruns</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>System Autoruns</h2>");
 
   // Run
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","Run");
 
   // RunOnce
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnce");
 
   // RunOnceEx
   ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnceEx");
 
   // TODO: There might be a Run under WindowsNT\CurrentVersion\Run too!
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SOFTWARE_ProfileList.qs b/trunk/report_templates/SOFTWARE_ProfileList.qs
index 435e7e0..3f00709 100644
--- a/trunk/report_templates/SOFTWARE_ProfileList.qs
+++ b/trunk/report_templates/SOFTWARE_ProfileList.qs
@@ -1,56 +1,51 @@
 function fred_report_info() {
   var info={report_cat    : "SOFTWARE",
             report_name   : "Profile list",
             report_author : "Gillen Daniel",
             report_desc   : "Dump profile list",
             fred_api      : 2,
             hive          : "SOFTWARE"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>Profile List</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Profile List</h2>");
 
   var profile_list=GetRegistryNodes("\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList");
   if(IsValid(profile_list) && profile_list.length>0) {
     for(var i=0;i<profile_list.length;i++) {
       println("  <p style=\"font-size:12; white-space:nowrap\">");
       println("    <u>"+profile_list[i]+"</u><br />");
       println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
       // Get profile image path
       val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\"+profile_list[i],"ProfileImagePath");
       print_table_row("Profile image path:",IsValid(val) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
 
       // Get last load time (Saved as 2 dwords. Another "good" idea of M$ ;-))
       var loadtime_low=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\"+profile_list[i],"ProfileLoadTimeLow");
       var loadtime_high=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\"+profile_list[i],"ProfileLoadTimeHigh");
       print_table_row("Profile load time:",(IsValid(loadtime_low) && IsValid(loadtime_high)) ? RegistryKeyValueToVariant(loadtime_low.value.append(loadtime_high.value),"filetime",0) : "n/a");
 
       // TODO: There is more to decode under \\Microsoft\\Windows NT\\CurrentVersion\\ProfileList
 
       println("    </table>");
       println("  </p>");
     }
     println("    </table>");
   } else {
     println("    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;None");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SOFTWARE_WindowsVersion.qs b/trunk/report_templates/SOFTWARE_WindowsVersion.qs
index 0a06fb3..b2151f4 100644
--- a/trunk/report_templates/SOFTWARE_WindowsVersion.qs
+++ b/trunk/report_templates/SOFTWARE_WindowsVersion.qs
@@ -1,109 +1,104 @@
 function fred_report_info() {
   var info={report_cat    : "SOFTWARE",
             report_name   : "Windows version",
             report_author : "Gillen Daniel",
             report_desc   : "Dump Windows version info",
             fred_api      : 2,
             hive          : "SOFTWARE"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function DecodeProductKey(arr) {
   //ProductKey is base24 encoded
   var keychars=new Array("B","C","D","F","G","H","J","K","M","P","Q","R","T","V","W","X","Y","2","3","4","6","7","8","9");
   var key=new Array(30);
   var ret="";
   var ncur;
 
   if(arr.length<66) return ret;
 
   arr=arr.mid(52,15);
   for(var ilbyte=24;ilbyte>=0;ilbyte--) {
     ncur=0;
     for(var ilkeybyte=14;ilkeybyte>=0;ilkeybyte--) {
       ncur=ncur*256^arr[ilkeybyte];
       arr[ilkeybyte]=ncur/24;
       ncur%=24;
     }
     ret=keychars[ncur]+ret;
     if(ilbyte%5==0 && ilbyte!=0) ret="-"+ret;
   }
   return ret;
 }
 
 function fred_report_html() {
-//  println("<html>");
-//  println("  <head><title>Windows version info</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Windows version info</h2>");
 
   // Windows version sp and build info
   var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","ProductName");
   if(IsValid(val)) {
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
     print("        <tr><td>Windows version:</td><td>",RegistryKeyValueToString(val.value,val.type));
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","CSDVersion");
     if(IsValid(val)) {
       print(" ",RegistryKeyValueToString(val.value,val.type));
     }
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","CurrentBuildNumber");
     if(IsValid(val)) {
       print(" build ",RegistryKeyValueToString(val.value,val.type));
     }
     println("</td></tr>");
     // Build string
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","BuildLab");
     print_table_row("Build string:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     // Extended build string
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","BuildLabEx");
     print_table_row("Extended build string:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
 
     // Install date
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","InstallDate");
     print_table_row("Install date:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"unixtime") : "n/a");
 
     // Owner and Organization info
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","RegisteredOwner");
     print_table_row("Registered owner:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","RegisteredOrganization");
     print_table_row("Registered organization:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
 
     // Windows ID / Key
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","ProductId");
     print_table_row("Product ID:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","DigitalProductId");
     if(IsValid(val)) {
       var key=DecodeProductKey(val.value);
       if(key!="BBBBB-BBBBB-BBBBB-BBBBB-BBBBB") print_table_row("Product Key:",key);
       else print_table_row("Product Key:","n/a (Probably a volume license key was used)");
     } else print_table_row("Product Key:","n/a");
 
     // Install directory / Source directory
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","PathName");
     print_table_row("Install path:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","SourcePath");
     print_table_row("Source path:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
 
     println("    </table>");
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    Unable to get product name!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SYSTEM_CurrentNetworkSettings.qs b/trunk/report_templates/SYSTEM_CurrentNetworkSettings.qs
index 7a6dac4..6a0a940 100644
--- a/trunk/report_templates/SYSTEM_CurrentNetworkSettings.qs
+++ b/trunk/report_templates/SYSTEM_CurrentNetworkSettings.qs
@@ -1,141 +1,136 @@
 function fred_report_info() {
   var info={report_cat    : "SYSTEM",
             report_name   : "Current network settings",
             report_author : "Gillen Daniel",
             report_desc   : "Dump current network settings",
             fred_api      : 2,
             hive          : "SYSTEM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function ZeroPad(number,padlen) {
   var ret=number.toString(10);
   if(!padlen || ret.length>=padlen) return ret;
   return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
 }
 
 function fred_report_html() {
   // See Appendix A: TCP/IP Configuration Parameters:
   // http://technet.microsoft.com/de-de/library/cc739819%28v=WS.10%29.aspx
   var val;
 
-//  println("<html>");
-//  println("  <head><title>Current Network Settings (Tcp/Ip)</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Current network settings (Tcp/Ip)</h2>");
 
   // Get current controlset
   var cur_controlset=GetRegistryKeyValue("\\Select","Current");
   if(IsValid(cur_controlset)) {
     cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
     // Current holds a DWORD value, thus we get a string like 0x00000000, but
     // control sets are referenced by its decimal representation.
     cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)
 
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
     print_table_row("Active control set:",cur_controlset);
 
     // Computer name
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\ComputerName\\ComputerName","ComputerName");
     print_table_row("Computer name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
 
     println("    </table>");
     println("    <br />");
 
     // Iterate over all available network adapters
     var adapters=GetRegistryNodes(cur_controlset+"\\Services\\Tcpip\\Parameters\\Adapters");
     for(var i=0;i<adapters.length;i++) {
       // Try to get a human readable name
       // According to http://technet.microsoft.com/de-de/library/cc780532%28v=ws.10%29.aspx
       // the {4D36E972-E325-11CE-BFC1-08002BE10318} key name might be (and hopefully is) static :)
       val=GetRegistryKeyValue(cur_controlset+"\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\"+adapters[i]+"\\Connection","Name");
       if(IsValid(val)) {
         println("    <u>",RegistryKeyValueToString(val.value,val.type),"</u>");
       } else {
         println("    <u>",adapters[i],"</u>");
       }
 
       // Get settings node
       var adapter_settings_node=GetRegistryKeyValue(cur_controlset+"\\Services\\Tcpip\\Parameters\\Adapters\\"+adapters[i],"IpConfig");
       adapter_settings_node=RegistryKeyValueToVariant(adapter_settings_node.value,"utf16",0);
 
       println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
       //print_table_row("Adapter id:",adapters[i]);
 
       // Get configuration mode
       val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"EnableDHCP");
       val=Number(RegistryKeyValueToString(val.value,val.type));
       if(val) {
         // DHCP enabled
         print_table_row("Configuration mode:","DHCP");
         // DHCP server
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpServer");
         print_table_row("Last used DHCP server:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // IP address
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpIPAddress");
         print_table_row("IP address:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // Subnet mask
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpSubnetMask");
         print_table_row("Subnet mask:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // Nameserver(s)
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpNameServer");
         print_table_row("Nameserver(s):",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // Domain
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpDomain");
         print_table_row("Domain:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // Default gw
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DhcpDefaultGateway");
         print_table_row("Default gateway:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"utf16",0) : "");
         // Lease obtained
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"LeaseObtainedTime");
         print_table_row("Lease obtained:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"unixtime",0) : "");
         // Lease valid until
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"LeaseTerminatesTime");
         print_table_row("Lease terminates:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"unixtime",0) : "");
       } else {
         print_table_row("Configuration mode:","Manual");
         // IP address
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"IPAddress");
         print_table_row("IP address:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"utf16",0) : "");
         // Subnet mask
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"SubnetMask");
         print_table_row("Subnet mask:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"utf16",0) : "");
         // Nameserver
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"NameServer");
         print_table_row("Nameserver:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"utf16",0) : "");
         // Domain
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"Domain");
         print_table_row("Domain:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
         // Default gw
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+adapter_settings_node,"DefaultGateway");
         print_table_row("Default gateway:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"utf16",0) : "");
       }
 
       // TODO: Check for EnableSecurityFilters, TCPAllowedPorts and UDPAllowedPorts to get firewall status.
 
       println("    </table>");
       println("    <br />");
 
       // TODO: Get persistent routes from \ControlSet001\Services\Tcpip\Parameters\PersistentRoutes
     }
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    Unable to determine current control set!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SYSTEM_Services.qs b/trunk/report_templates/SYSTEM_Services.qs
index 4344e66..64c2748 100644
--- a/trunk/report_templates/SYSTEM_Services.qs
+++ b/trunk/report_templates/SYSTEM_Services.qs
@@ -1,111 +1,106 @@
 function fred_report_info() {
   var info={report_cat    : "SYSTEM",
             report_name   : "Services",
             report_author : "Gillen Daniel",
             report_desc   : "Dump services",
             fred_api      : 2,
             hive          : "SYSTEM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function ZeroPad(number,padlen) {
   var ret=number.toString(10);
   if(!padlen || ret.length>=padlen) return ret;
   return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
 }
 
 function PrintTableRow(cell01,cell02,cell03,cell04,cell05) {
   println("      <tr><td style=\"padding:2px\">",cell01,"</td><td style=\"padding:2px\">",cell02,"</td><td style=\"padding:2px\">",cell03,"</td><td style=\"padding:2px\">",cell04,"</td><td style=\"padding:2px\">",cell05,"</td></tr>");
 }
 
 function ListService(service_node) {
   // Service name
   var name=GetRegistryKeyValue(service_node,"DisplayName");
   name=(IsValid(name)) ? RegistryKeyValueToString(name.value,name.type) : "Unknwon";
   // Service group
   var group=GetRegistryKeyValue(service_node,"Group");
   group=(IsValid(group)) ? RegistryKeyValueToString(group.value,group.type) : "";
   // Service exe
   var image=GetRegistryKeyValue(service_node,"ImagePath");
   image=(IsValid(image)) ? RegistryKeyValueToString(image.value,image.type) : "Unknwon";
   // Start
   var start=GetRegistryKeyValue(service_node,"Start");
   start=(IsValid(start)) ? RegistryKeyValueToString(start.value,start.type) : -1;
   switch(Number(start)) {
     case 0:
       start="Boot";
       break;
     case 1:
       start="System";
       break;
     case 2:
       start="Automatic";
       break;
     case 3:
       start="Manual";
       break;
     case 4:
       start="Disabled";
       break;
     default:
       start="Unknown";
   }
   // Description
   var desc=GetRegistryKeyValue(service_node,"Description");
   desc=(IsValid(desc)) ? RegistryKeyValueToString(desc.value,desc.type) : "";
   
   PrintTableRow(name,group,start,image,desc)
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>Services</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Services</h2>");
 
   // Get current controlset
   var cur_controlset=GetRegistryKeyValue("\\Select","Current");
   if(IsValid(cur_controlset)) {
     cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
     // Current holds a DWORD value, thus we get a string like 0x00000000, but
     // control sets are referenced by its decimal representation.
     cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)
 
     // Get list of possible services
     var services=GetRegistryNodes(cur_controlset+"\\Services");
     if(IsValid(services)) {
       println("  <p style=\"font-size:12; white-space:nowrap\">");
       println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
       println("      <tr><td style=\"padding:2px\"><b>Name</b></td><td style=\"padding:2px\"><b>Group</b></td><td><b>Startup</b></td><td style=\"padding:2px\"><b>Image path</b></td><td style=\"padding:2px\"><b>Description</b></td></tr>");
       for(var i=0;i<services.length;i++) {
         // Get service type
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\"+services[i],"Type");
         if(!IsValid(val)) continue;
         val=RegistryKeyValueToString(val.value,val.type);
         if(Number(val)!=16 && Number(val)!=32) continue;
         ListService(cur_controlset+"\\Services\\"+services[i]);
       }
       println("    </table>");
       println("  </p>");
     } else {
       println("  <p><font color='red'>");
       println("    This registry hive does not contain any services!<br />");
       println("  </font></p>");
     }
   } else {
     println("  <p><font color='red'>");
     println("    Unable to determine current control set!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SYSTEM_ShutdownTime.qs b/trunk/report_templates/SYSTEM_ShutdownTime.qs
index 443552b..1e5ce77 100644
--- a/trunk/report_templates/SYSTEM_ShutdownTime.qs
+++ b/trunk/report_templates/SYSTEM_ShutdownTime.qs
@@ -1,57 +1,52 @@
 function fred_report_info() {
   var info={report_cat    : "SYSTEM",
             report_name   : "Shutdown time",
             report_author : "Gillen Daniel",
             report_desc   : "Dump last known shutdown time",
             fred_api      : 2,
             hive          : "SYSTEM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>Last known shutdown time</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>Last known shutdown time</h2>");
 
   // Get current controlset
   var cur_controlset=GetRegistryKeyValue("\\Select","Current");
   if(IsValid(cur_controlset)) {
     cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
     // Current holds a DWORD value, thus we get a string like 0x00000000, but
     // control sets are referenced only with the last 3 digits.
     cur_controlset="ControlSet"+String(cur_controlset).substr(7,3);
 
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
     print_table_row("Active control set:",cur_controlset);
 
     // Shutdown time
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\Windows","ShutdownTime");
     print_table_row("Shutdown time:",(IsValid(val)) ? RegistryKeyValueToVariant(val.value,"filetime") : "Unknown");
 
     println("    </table>");
     println("    <br />");
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    Unable to determine current control set!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SYSTEM_SystemTimeInfo.qs b/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
index 588a14a..0f7ae70 100644
--- a/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
+++ b/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
@@ -1,122 +1,117 @@
 function fred_report_info() {
   var info={report_cat    : "SYSTEM",
             report_name   : "System time info",
             report_author : "Gillen Daniel",
             report_desc   : "Dump system time info",
             fred_api      : 2,
             hive          : "SYSTEM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function ToUTC(num) {
   var retnum=new Number(num);
   if(retnum&0x80000000) {
     retnum=((0xFFFFFFFF-retnum)+1)/60;
     return "UTC+"+Number(retnum).toString(10);
   } else {
     retnum=retnum/60;
     if(retnum!=0) return "UTC-"+Number(retnum).toString(10);
     else return "UTC+"+Number(retnum).toString(10);
   }
 }
 
 function ZeroPad(number,padlen) {
   var ret=number.toString(10);
   if(!padlen || ret.length>=padlen) return ret;
   return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
 }
 
 function fred_report_html() {
   var val;
 
-//  println("<html>");
-//  println("  <head><title>System Time Info</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>System time info</h2>");
 
   // Get current controlset
   var cur_controlset=GetRegistryKeyValue("\\Select","Current");
   if(IsValid(cur_controlset)) {
     cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
     // Current holds a DWORD value, thus we get a string like 0x00000000, but
     // control sets are referenced by its decimal representation.
     cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)
 
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <u>Time zone info</u>");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
     // Active time bias
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","ActiveTimeBias");
     print_table_row("Active time bias:",(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a");
 
     // Std. tz name and bias
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","StandardName");
     print_table_row("Std. time zone name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","StandardBias");
     print_table_row("Std. time bias:",(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a");
 
     // Daylight tz name and bias
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","DaylightName");
     print_table_row("Daylight time zone name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
     val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","DaylightBias");
     print_table_row("Daylight time bias:",(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a");
 
     println("    </table>");
     println("    <br />");
     println("    <u>W32Time service info</u>");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
     // Get W32Time service settings
     val=GetRegistryKeyValue(cur_controlset+"\\Services\\W32Time","Start");
     if(IsValid(val)) {
       print("      <tr><td>Startup method:</td><td>");
       val=RegistryKeyValueToString(val.value,val.type);
       switch(Number(val)) {
         case 0:
           print("Boot");
           break;
         case 1:
           print("System");
           break;
         case 2:
           print("Automatic");
           break;
         case 3:
           print("Manual");
           break;
         case 4:
           print("Disabled");
           break;
         default:
           print("Unknown");
       }
       println("</td></tr>");
       // If service is enabled, get ntp server
       if(Number(val)<4) {
         val=GetRegistryKeyValue(cur_controlset+"\\Services\\W32Time\\Parameters","NtpServer");
         print_table_row("NTP server(s):",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a");
       }
     } else print_table_row("Startup method:","n/a");
 
     println("    </table>");
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    Unable to determine current control set!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }
diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
index e7cded4..20667d0 100644
--- a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
+++ b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
@@ -1,150 +1,145 @@
 function fred_report_info() {
   var info={report_cat    : "SYSTEM",
             report_name   : "USB storage devices",
             report_author : "Gillen Daniel",
             report_desc   : "Dump USB storage devices",
             fred_api      : 2,
             hive          : "SYSTEM"
   };
   return info;
 }
 
 function IsValid(val) {
   if(typeof val !== 'undefined') return true;
   else return false;
 }
 
 function print_table_row(cell01,cell02) {
   println("      <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
 }
 
 function ZeroPad(number,padlen) {
   var ret=number.toString(10);
   if(!padlen || ret.length>=padlen) return ret;
   return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
 }
 
 function fred_report_html() {
   // TODO: There is more here. Check http://www.forensicswiki.org/wiki/USB_History_Viewing
   var val;
 
-//  println("<html>");
-//  println("  <head><title>USB Storage Devices</title></head>");
-//  println("  <body style=\"font-size:12\">");
   println("  <h2>USB storage devices</h2>");
 
   // Preload MountedDevices to possibly identify mount points of USB storage devices
   var mnt_keys=GetRegistryKeys("\\MountedDevices");
   var mnt_values=new Array();
   if(IsValid(mnt_keys)) {
     for(var i=0;i<mnt_keys.length;i++) {
       val=GetRegistryKeyValue("\\MountedDevices",mnt_keys[i]);
       mnt_values[i]=RegistryKeyValueToVariant(val.value,"utf16");
     }
   }
 
   // Get current controlset
   var cur_controlset=GetRegistryKeyValue("\\Select","Current");
   if(IsValid(cur_controlset)) {
     cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
     // Current holds a DWORD value, thus we get a string like 0x00000000, but
     // control sets are referenced by its decimal representation.
     cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)
 
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <u>Settings</u><br />");
     println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
 
     // Are USB storage devices enabled?
     // http://www.forensicmag.com/article/windows-7-registry-forensics-part-5
     // Is this true for WinXP etc.. ???
     var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start");
     if(IsValid(val)) {
       val=RegistryKeyValueToString(val.value,val.type);
       val=parseInt(String(val).substr(2,8),10);
       switch(val) {
         case 3:
           print_table_row("Storage driver enabled:","Yes");
           break;
         case 4:
           print_table_row("Storage driver enabled:","No");
           break;
         default:
           print_table_row("Storage driver enabled:","Unknown");
       }
     } else {
       print_table_row("Storage driver enabled:","Unknown");
     }
 
     println("    </table>");
     println("  </p>");
     println("  <p style=\"font-size:12; white-space:nowrap\">");
     println("    <u>Devices</u><br />");
 
     var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
     if(IsValid(storage_roots)) {
       for(var i=0;i<storage_roots.length;i++) {
         println("    <u style=\"margin-left:20px; font-size:12; white-space:nowrap\">",storage_roots[i],"</u><br />");
         var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]);
         for(ii=0;ii<storage_subroots.length;ii++) {
           println("    <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
           // If the second character of the unique instance ID is a '&', then the ID was
           // generated by the system, as the device did not have a serial number.
           if(String(storage_subroots[ii]).charAt(1)=="&") print_table_row("Unique ID:",storage_subroots[ii]+" (Generated by system)");
           else print_table_row("Unique ID:",storage_subroots[ii]);
 
           val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"Class");
           print_table_row("Class:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
           val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"DeviceDesc");
           print_table_row("Device description:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
           val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"FriendlyName");
           print_table_row("Friendly name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
           val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"ParentIdPrefix");
           if(IsValid(val)) {
             // Windows XP uses the ParentId to link to MountedDevices
             var parent_id=RegistryKeyValueToString(val.value,val.type);
             print_table_row("Parent ID prefix:",parent_id);
             // Find mount point(s)
             print("      <tr><td>Mount point(s):</td><td>");
             var br=0;
             for(var iii=0;iii<mnt_keys.length;iii++) {
               if(String(mnt_values[iii]).indexOf("#"+parent_id+"&")!=-1) {
                 if(br==1) print("<br />");
                 else br=1;
                 print(mnt_keys[iii]);
               }
             }
             if(br==0) print("n/a");
             println("</td></tr>");
           } else {
             // Since Vista, Unique IDs are used
             // Find mount point(s)
             print("      <tr><td>Mount point(s):</td><td>");
             var br=0;
             for(var iii=0;iii<mnt_keys.length;iii++) {
               if(String(mnt_values[iii]).indexOf("#"+storage_subroots[ii]+"#")!=-1) {
                 if(br==1) print("<br />");
                 else br=1;
                 print(mnt_keys[iii]);
               }
             }
             if(br==0) print("n/a");
             println("</td></tr>");
           }
           println("    </table>");
           println("    <br />");
         }
       }
     } else {
       println("  <font color='red'>This registry hive does not contain a list of attached USB storage devices!</font>");
     }
     println("  </p>");
   } else {
     println("  <p><font color='red'>");
     println("    Unable to determine current control set!<br />");
     println("    Are you sure you are running this report against the correct registry hive?");
     println("  </font></p>");
   }
-
-//  println("</html>");
 }