regfi
Functions
Parsing Layer: Direct Data Structure Access

Functions

REGFI_NKregfi_parse_nk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses an NK record at the specified offset. More...
 
REGFI_SUBKEY_LISTregfi_parse_subkeylist (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses a single cell containing a subkey-list record. More...
 
REGFI_VKregfi_parse_vk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses a VK (value) record at the specified offset. More...
 
REGFI_SKregfi_parse_sk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses an SK (security) record at the specified offset. More...
 
range_listregfi_parse_unalloc_cells (REGFI_FILE *file)
 Retrieves information on all cells in the registry hive which are currently in the unallocated status. More...
 
bool regfi_parse_cell (REGFI_RAW_FILE *file_cb, uint32_t offset, uint8_t *hdr, uint32_t hdr_len, uint32_t *cell_length, bool *unalloc)
 Helper function to parse a cell. More...
 
uint8_t * regfi_parse_classname (REGFI_FILE *file, uint32_t offset, uint16_t *name_length, uint32_t max_size, bool strict)
 Parses a classname cell. More...
 
REGFI_BUFFER regfi_parse_data (REGFI_FILE *file, uint32_t offset, uint32_t length, bool strict)
 Parses a single-cell data record. More...
 
REGFI_BUFFER regfi_parse_little_data (REGFI_FILE *file, uint32_t voffset, uint32_t length, bool strict)
 Parses a "little data" record which is stored entirely within the provided virtual offset. More...
 

Detailed Description

Function Documentation

◆ regfi_parse_nk()

REGFI_NK* regfi_parse_nk ( REGFI_FILE file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses an NK record at the specified offset.

Parameters
filethe registry file structure
offsetthe offset of the cell (not the record) to be parsed.
max_sizethe maximum size the NK cell could be. (for validation)
strictif true, rejects any malformed records. Otherwise, tries to minimally validate integrity.
Returns
A newly allocated NK record structure, or NULL on failure.

◆ regfi_parse_subkeylist()

REGFI_SUBKEY_LIST* regfi_parse_subkeylist ( REGFI_FILE file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses a single cell containing a subkey-list record.

XXX: finish documenting

◆ regfi_parse_vk()

REGFI_VK* regfi_parse_vk ( REGFI_FILE file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses a VK (value) record at the specified offset.

XXX: finish documenting

◆ regfi_parse_sk()

REGFI_SK* regfi_parse_sk ( REGFI_FILE file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses an SK (security) record at the specified offset.

XXX: finish documenting

◆ regfi_parse_unalloc_cells()

range_list* regfi_parse_unalloc_cells ( REGFI_FILE file)

Retrieves information on all cells in the registry hive which are currently in the unallocated status.


The unallocated status is determined based soley on the cell length sign.

XXX: finish documenting

References range_list_new().

◆ regfi_parse_cell()

bool regfi_parse_cell ( REGFI_RAW_FILE file_cb,
uint32_t  offset,
uint8_t *  hdr,
uint32_t  hdr_len,
uint32_t *  cell_length,
bool *  unalloc 
)

Helper function to parse a cell.

XXX: finish documenting

◆ regfi_parse_classname()

uint8_t* regfi_parse_classname ( REGFI_FILE file,
uint32_t  offset,
uint16_t *  name_length,
uint32_t  max_size,
bool  strict 
)

Parses a classname cell.

XXX: finish documenting

◆ regfi_parse_data()

REGFI_BUFFER regfi_parse_data ( REGFI_FILE file,
uint32_t  offset,
uint32_t  length,
bool  strict 
)

Parses a single-cell data record.

XXX: finish documenting

◆ regfi_parse_little_data()

REGFI_BUFFER regfi_parse_little_data ( REGFI_FILE file,
uint32_t  voffset,
uint32_t  length,
bool  strict 
)

Parses a "little data" record which is stored entirely within the provided virtual offset.

XXX: finish documenting