regfi
Data Fields

Value structure. More...

Data Fields

uint32_t offset
 Real offset of this record's cell in the file.
 
uint32_t cell_size
 ((start_offset - end_offset) & 0xfffffff8)
 
char * name
 The name of this value converted to desired REGFI_ENCODING. More...
 
uint8_t * name_raw
 The raw value name. More...
 
uint16_t name_length
 Length of name_raw.
 
uint32_t hbin_off
 Offset from beginning of this hbin block.
 
uint32_t data_size
 Size of the value's data as reported in the VK record. More...
 
uint32_t data_off
 Virtual offset of data cell.
 
REGFI_DATA_TYPE type
 Value's data type.
 
uint8_t magic [REGFI_CELL_MAGIC_SIZE]
 VK record's magic number (should be "vk")
 
uint16_t flags
 VK record flags.
 
bool data_in_offset
 Whether or not the data record is stored in the VK record's data_off field. More...
 

Detailed Description

Value structure.

Field Documentation

◆ name

char* _regfi_vk::name

The name of this value converted to desired REGFI_ENCODING.


This conversion typically occurs automatically through REGFI_ITERATOR settings. String is NUL terminated.

◆ name_raw

uint8_t* _regfi_vk::name_raw

The raw value name.

Length of the buffer is stored in name_length.

◆ data_size

uint32_t _regfi_vk::data_size

Size of the value's data as reported in the VK record.

May be different than that obtained while parsing the data cell itself.

◆ data_in_offset

bool _regfi_vk::data_in_offset

Whether or not the data record is stored in the VK record's data_off field.

This information is derived from the high bit of the raw data size field.


The documentation for this struct was generated from the following file: