Value structure. More...
Collaboration diagram for REGFI_VK:
Data Fields | |
| uint32_t | offset |
| Real offset of this record's cell in the file. | |
| uint32_t | cell_size |
| ((start_offset - end_offset) & 0xfffffff8) | |
| char * | name |
| The name of this value converted to desired REGFI_ENCODING. More... | |
| uint8_t * | name_raw |
| The raw value name. More... | |
| uint16_t | name_length |
| Length of name_raw. | |
| uint32_t | hbin_off |
| Offset from beginning of this hbin block. | |
| uint32_t | data_size |
| Size of the value's data as reported in the VK record. More... | |
| uint32_t | data_off |
| Virtual offset of data cell. | |
| REGFI_DATA_TYPE | type |
| Value's data type. | |
| uint8_t | magic [REGFI_CELL_MAGIC_SIZE] |
| VK record's magic number (should be "vk") | |
| uint16_t | flags |
| VK record flags. | |
| bool | data_in_offset |
| Whether or not the data record is stored in the VK record's data_off field. More... | |
Detailed Description
Value structure.
Field Documentation
◆ name
| char* REGFI_VK::name |
The name of this value converted to desired REGFI_ENCODING.
This conversion typically occurs automatically through REGFI_ITERATOR settings. String is NUL terminated.
Referenced by regfi_find_value().
◆ name_raw
| uint8_t* REGFI_VK::name_raw |
The raw value name.
Length of the buffer is stored in name_length.
◆ data_size
| uint32_t REGFI_VK::data_size |
Size of the value's data as reported in the VK record.
May be different than that obtained while parsing the data cell itself.
Referenced by regfi_fetch_data().
◆ data_in_offset
| bool REGFI_VK::data_in_offset |
Whether or not the data record is stored in the VK record's data_off field.
This information is derived from the high bit of the raw data size field.
Referenced by regfi_fetch_data().
The documentation for this struct was generated from the following file:
