Glue Layer: Logical Data Structure Loading

Functions
REGFI_NK *	regfi_load_key (REGFI_FILE *file, uint32_t offset, bool strict)
	Loads a key and associated data structures given a file offset. More...
REGFI_VK *	regfi_load_value (REGFI_FILE *file, uint32_t offset, bool strict)
	Loads a value at a given file offset alng with associated data structures. More...
REGFI_SUBKEY_LIST *	regfi_load_subkeylist (REGFI_FILE *file, uint32_t offset, uint32_t num_keys, uint32_t max_size, bool strict)
	Loads a logical subkey list in its entirety which may span multiple records. More...
REGFI_VALUE_LIST *	regfi_load_valuelist (REGFI_FILE *file, uint32_t offset, uint32_t num_values, uint32_t max_size, bool strict)
	Loads a valuelist. More...
REGFI_BUFFER	regfi_load_data (REGFI_FILE *file, uint32_t voffset, uint32_t length, bool data_in_offset, bool strict)
	Loads a data record which may be contained in the virtual offset, in a single cell, or in multiple cells through big data records. More...
REGFI_BUFFER	regfi_load_big_data (REGFI_FILE *file, uint32_t offset, uint32_t data_length, uint32_t cell_length, range_list *used_ranges, bool strict)
	Loads the data associated with a big data record at the specified offset. More...
bool	regfi_interpret_data (REGFI_FILE *file, uint32_t type, REGFI_DATA *data)
	Given raw data, attempts to interpret the data based on a specified registry data type. More...
const REGFI_SK *	regfi_load_sk (REGFI_FILE *file, uint32_t offset, bool strict)
	Loads an "sk" security record at the specified offset. More...
const REGFI_HBIN *	regfi_lookup_hbin (REGFI_FILE *file, uint32_t offset)
	Retrieves the HBIN data structure stored at the specified offset. More...

Detailed Description

Function Documentation

regfi_load_key()

REGFI_NK* regfi_load_key	(	REGFI_FILE *	file,
		uint32_t	offset,
		bool	strict
	)

Loads a key and associated data structures given a file offset.

XXX: finish documenting

Referenced by regfi_get_subkey(), regfi_iterator_ancestry(), and regfi_iterator_cur_key().

regfi_load_value()

REGFI_VK* regfi_load_value	(	REGFI_FILE *	file,
		uint32_t	offset,
		bool	strict
	)

Loads a value at a given file offset alng with associated data structures.

XXX: finish documenting

Referenced by regfi_get_value().

regfi_load_subkeylist()

REGFI_SUBKEY_LIST* regfi_load_subkeylist	(	REGFI_FILE *	file,
		uint32_t	offset,
		uint32_t	num_keys,
		uint32_t	max_size,
		bool	strict
	)

Loads a logical subkey list in its entirety which may span multiple records.

XXX: finish documenting

regfi_load_valuelist()

REGFI_VALUE_LIST* regfi_load_valuelist	(	REGFI_FILE *	file,
		uint32_t	offset,
		uint32_t	num_values,
		uint32_t	max_size,
		bool	strict
	)

Loads a valuelist.

XXX: finish documenting

regfi_load_data()

REGFI_BUFFER regfi_load_data	(	REGFI_FILE *	file,
		uint32_t	voffset,
		uint32_t	length,
		bool	data_in_offset,
		bool	strict
	)

Loads a data record which may be contained in the virtual offset, in a single cell, or in multiple cells through big data records.

XXX: finish documenting

Referenced by regfi_fetch_data().

regfi_load_big_data()

REGFI_BUFFER regfi_load_big_data	(	REGFI_FILE *	file,
		uint32_t	offset,
		uint32_t	data_length,
		uint32_t	cell_length,
		range_list *	used_ranges,
		bool	strict
	)

Loads the data associated with a big data record at the specified offset.

XXX: finish documenting

regfi_interpret_data()

bool regfi_interpret_data	(	REGFI_FILE *	file,
		uint32_t	type,
		REGFI_DATA *	data
	)

Given raw data, attempts to interpret the data based on a specified registry data type.

XXX: finish documenting

regfi_load_sk()

const REGFI_SK* regfi_load_sk	(	REGFI_FILE *	file,
		uint32_t	offset,
		bool	strict
	)

Loads an "sk" security record at the specified offset.

XXX: finish documenting

regfi_lookup_hbin()

const REGFI_HBIN* regfi_lookup_hbin	(	REGFI_FILE *	file,
		uint32_t	offset
	)

Retrieves the HBIN data structure stored at the specified offset.

XXX: finish documenting

References range_list_find_data().