Hey, i know the 5 registry hives have large 8-digit values for their handles and i have written a function which maps the value to the hive name.
However, i'm also getting (in my data) much smaller numbers like 60, 120 etc and i have no idea which registry keys these represent. What could i do to find out?
You should have to write a function which maps the value to the hive name. These are reserved values which will always give you the hive, no matter what.
As for mapping handle values to the registry path, that's simply a bad idea. There is no guarantee that the handle values are able to be mapped back to the path. Once you close them, there is nothing to say that when you open the path again, you will get the same value back.
Basically, you can map from a path to a handle, which you would then perform operations on, but you can't map a handle back to a path, unless you plan on keeping all the handles open, which generally is a bad idea, as you would be wasting resources just for this mapping.