FInd root key fix

Author: EricZimmerman

Registry.Test/TestRegistryHive.cs

@@ -5,6 +5,7 @@
 using NFluent;
 using NLog;
 using NUnit.Framework;
+using Registry.Cells;
 using Registry.Other;
 
 namespace Registry.Test
@@ -663,12 +664,17 @@ public void HBinSizeShouldNotMatchReadSize()
         }
 
         [Test]
-        [Ignore("Unknown test source file.")]
+        
         public void OneOff()
         {
-            var r = new RegistryHive(@"C:\Users\eric\Desktop\SAM");
+            var r = new RegistryHive(@"C:\temp\SYSTEM");
             r.RecoverDeleted = true;
+            r.FlushRecordListsAfterParse = false;
             r.ParseHive();
+
+            var sss = r.CellRecords.Values.OfType<NkCellRecord>().Where(f =>
+                (f.Flags & NkCellRecord.FlagEnum.HiveEntryRootKey) == NkCellRecord.FlagEnum.HiveEntryRootKey);
+
         }
 
 

Registry/Registry.csproj

@@ -10,9 +10,10 @@
     <Copyright>Eric Zimmerman</Copyright>
     <PackageProjectUrl>https://github.com/EricZimmerman/Registry</PackageProjectUrl>
     <RepositoryUrl>https://github.com/EricZimmerman/Registry</RepositoryUrl>
-    <AssemblyVersion>1.1.0.0</AssemblyVersion>
-    <FileVersion>1.1.0.0</FileVersion>
-    <Version>1.1.0.0</Version>
+    <AssemblyVersion>1.1.0.1</AssemblyVersion>
+    <FileVersion>1.1.0.1</FileVersion>
+    <Version>1.1.0.1</Version>
+    <PackageLicenseExpression>MIT</PackageLicenseExpression>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Release|netstandard2.0|AnyCPU'">

Registry/RegistryHive.cs

@@ -958,7 +958,7 @@ public bool ParseHive()
             //here we are looking for the flag
             var rootNode =
                 CellRecords.Values.OfType<NkCellRecord>()
-                    .SingleOrDefault(
+                    .FirstOrDefault(
                         f =>
                             (f.Flags & NkCellRecord.FlagEnum.HiveEntryRootKey) ==
                             NkCellRecord.FlagEnum.HiveEntryRootKey);