Loading...
Searching...
No Matches
Glue Layer: Logical Data Structure Loading

## Functions

REGFI_NK * | regfi_load_key (REGFI_FILE *file, uint32_t offset, bool strict)
| Loads a key and associated data structures given a file offset.
REGFI_VK * | regfi_load_value (REGFI_FILE *file, uint32_t offset, bool strict)
| Loads a value at a given file offset alng with associated data structures.
REGFI_SUBKEY_LIST * | regfi_load_subkeylist (REGFI_FILE *file, uint32_t offset, uint32_t num_keys, uint32_t max_size, bool strict)
| Loads a logical subkey list in its entirety which may span multiple records.
REGFI_VALUE_LIST * | regfi_load_valuelist (REGFI_FILE *file, uint32_t offset, uint32_t num_values, uint32_t max_size, bool strict)
| Loads a valuelist.
REGFI_BUFFER | regfi_load_data (REGFI_FILE *file, uint32_t voffset, uint32_t length, bool data_in_offset, bool strict)
| Loads a data record which may be contained in the virtual offset, in a single cell, or in multiple cells through big data records.
REGFI_BUFFER | regfi_load_big_data (REGFI_FILE *file, uint32_t offset, uint32_t data_length, uint32_t cell_length, range_list *used_ranges, bool strict)
| Loads the data associated with a big data record at the specified offset.
bool | regfi_interpret_data (REGFI_FILE *file, uint32_t type, REGFI_DATA *data)
| Given raw data, attempts to interpret the data based on a specified registry data type.
const REGFI_SK * | regfi_load_sk (REGFI_FILE *file, uint32_t offset, bool strict)
| Loads an "sk" security record at the specified offset.
const REGFI_HBIN * | regfi_lookup_hbin (REGFI_FILE *file, uint32_t offset)
| Retrieves the HBIN data structure stored at the specified offset.

## Detailed Description

## Function Documentation

## regfi_load_key()

REGFI_NK * regfi_load_key | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | bool | strict
| ) |  |

Loads a key and associated data structures given a file offset.

XXX: finish documenting

References lru_cache_find(), lru_cache_update(), REGFI_NK::num_subkeys, REGFI_NK::num_values, regfi_load_subkeylist(), regfi_load_valuelist(), regfi_parse_nk(), REGFI_NK::subkeys, REGFI_NK::subkeys_off, REGFI_NK::values, and REGFI_NK::values_off.

Referenced by regfi_get_parentkey(), regfi_get_rootkey(), regfi_get_subkey(), regfi_iterator_ancestry(), and regfi_iterator_cur_key().

## regfi_load_value()

REGFI_VK * regfi_load_value | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | bool | strict
| ) |  |

Loads a value at a given file offset alng with associated data structures.

XXX: finish documenting

References regfi_parse_vk().

Referenced by regfi_get_value().

## regfi_load_subkeylist()

REGFI_SUBKEY_LIST * regfi_load_subkeylist | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | uint32_t | num_keys,
|  | uint32_t | max_size,
|  | bool | strict
| ) |  |

Loads a logical subkey list in its entirety which may span multiple records.

XXX: finish documenting

Referenced by regfi_load_key().

## regfi_load_valuelist()

REGFI_VALUE_LIST * regfi_load_valuelist | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | uint32_t | num_values,
|  | uint32_t | max_size,
|  | bool | strict
| ) |  |

Loads a valuelist.

XXX: finish documenting

Referenced by regfi_load_key().

## regfi_load_data()

REGFI_BUFFER regfi_load_data | ( | REGFI_FILE * | file,
|  | uint32_t | voffset,
|  | uint32_t | length,
|  | bool | data_in_offset,
|  | bool | strict
| ) |  |

Loads a data record which may be contained in the virtual offset, in a single cell, or in multiple cells through big data records.

XXX: finish documenting

References regfi_load_big_data(), regfi_parse_cell(), regfi_parse_data(), and regfi_parse_little_data().

Referenced by regfi_fetch_data().

## regfi_load_big_data()

REGFI_BUFFER regfi_load_big_data | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | uint32_t | data_length,
|  | uint32_t | cell_length,
|  | range_list * | used_ranges,
|  | bool | strict
| ) |  |

Loads the data associated with a big data record at the specified offset.

XXX: finish documenting

References range_list_add(), range_list_free(), and range_list_get().

Referenced by regfi_load_data().

## regfi_interpret_data()

bool regfi_interpret_data | ( | REGFI_FILE * | file,
|  | uint32_t | type,
|  | REGFI_DATA * | data
| ) |  |

Given raw data, attempts to interpret the data based on a specified registry data type.

XXX: finish documenting

References REGFI_DATA::_regfi_data_interpreted::binary, REGFI_DATA::_regfi_data_interpreted::dword, REGFI_DATA::_regfi_data_interpreted::dword_be, REGFI_DATA::_regfi_data_interpreted::full_resource_descriptor, REGFI_DATA::interpreted_size, REGFI_DATA::_regfi_data_interpreted::multiple_string, REGFI_DATA::_regfi_data_interpreted::none, REGFI_DATA::_regfi_data_interpreted::qword, REGFI_DATA::raw, REGFI_DATA::_regfi_data_interpreted::resource_list, REGFI_DATA::_regfi_data_interpreted::resource_requirements_list, REGFI_DATA::size, REGFI_DATA::_regfi_data_interpreted::string, REGFI_FILE::string_encoding, and REGFI_DATA::type.

Referenced by regfi_fetch_data().

## regfi_load_sk()

const REGFI_SK * regfi_load_sk | ( | REGFI_FILE * | file,
|  | uint32_t | offset,
|  | bool | strict
| ) |  |

Loads an "sk" security record at the specified offset.

XXX: finish documenting

References lru_cache_find(), lru_cache_update(), and regfi_parse_sk().

Referenced by regfi_fetch_sk(), regfi_next_sk(), and regfi_prev_sk().

## regfi_lookup_hbin()

const REGFI_HBIN * regfi_lookup_hbin | ( | REGFI_FILE * | file,
|  | uint32_t | offset
| ) |  |

Retrieves the HBIN data structure stored at the specified offset.

XXX: finish documenting

References range_list_find_data().