I had reserved the Demo named "Tool for Protect and Restore regedit" half a year ago, but now it is useless to me. I think may be this ugly code could give you some informations,eg: IAT HOOK, how to get sectors for Hive file, SCSI command for read write disk, how to redirect data to other sectors. etc.

Links:

http://www.debugman.com/read.php?tid=3570&page=1&toread=1
http://hi.baidu.com/sudami/blog/item/d07e94139e4ccb0a5aaf539e.html
http://www.debugman.com/read.php?tid=2849&page=e&#a

It is an interesting thing for me to study Multi-point restore,oho.

逆向sysnap注册表还原_src.V 1.08.rar (218.07 KB) | Reverse_Sysnap_RegeditRestore_src.V%201.08.rar