regfi
Functions
Parsing Layer: Direct Data Structure Access

Functions

REGFI_NK * regfi_parse_nk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses an NK record at the specified offset. More...
 
REGFI_SUBKEY_LIST * regfi_parse_subkeylist (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses a single cell containing a subkey-list record. More...
 
REGFI_VK * regfi_parse_vk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses a VK (value) record at the specified offset. More...
 
REGFI_SK * regfi_parse_sk (REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
 Parses an SK (security) record at the specified offset. More...
 
range_list * regfi_parse_unalloc_cells (REGFI_FILE *file)
 Retrieves information on all cells in the registry hive which are currently in the unallocated status. More...
 
bool regfi_parse_cell (REGFI_RAW_FILE *file_cb, uint32_t offset, uint8_t *hdr, uint32_t hdr_len, uint32_t *cell_length, bool *unalloc)
 Helper function to parse a cell. More...
 
uint8_t * regfi_parse_classname (REGFI_FILE *file, uint32_t offset, uint16_t *name_length, uint32_t max_size, bool strict)
 Parses a classname cell. More...
 
REGFI_BUFFER regfi_parse_data (REGFI_FILE *file, uint32_t offset, uint32_t length, bool strict)
 Parses a single-cell data record. More...
 
REGFI_BUFFER regfi_parse_little_data (REGFI_FILE *file, uint32_t voffset, uint32_t length, bool strict)
 Parses a "little data" record which is stored entirely within the provided virtual offset. More...
 

Detailed Description

Function Documentation

◆ regfi_parse_nk()

REGFI_NK* regfi_parse_nk ( REGFI_FILE *  file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses an NK record at the specified offset.

Parameters
filethe registry file structure
offsetthe offset of the cell (not the record) to be parsed.
max_sizethe maximum size the NK cell could be. (for validation)
strictif true, rejects any malformed records. Otherwise, tries to minimally validate integrity.
Returns
A newly allocated NK record structure, or NULL on failure.

◆ regfi_parse_subkeylist()

REGFI_SUBKEY_LIST* regfi_parse_subkeylist ( REGFI_FILE *  file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses a single cell containing a subkey-list record.

XXX: finish documenting

◆ regfi_parse_vk()

REGFI_VK* regfi_parse_vk ( REGFI_FILE *  file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses a VK (value) record at the specified offset.

XXX: finish documenting

◆ regfi_parse_sk()

REGFI_SK* regfi_parse_sk ( REGFI_FILE *  file,
uint32_t  offset,
uint32_t  max_size,
bool  strict 
)

Parses an SK (security) record at the specified offset.

XXX: finish documenting

◆ regfi_parse_unalloc_cells()

range_list* regfi_parse_unalloc_cells ( REGFI_FILE *  file)

Retrieves information on all cells in the registry hive which are currently in the unallocated status.


The unallocated status is determined based soley on the cell length sign.

XXX: finish documenting

References range_list_new().

◆ regfi_parse_cell()

bool regfi_parse_cell ( REGFI_RAW_FILE *  file_cb,
uint32_t  offset,
uint8_t *  hdr,
uint32_t  hdr_len,
uint32_t *  cell_length,
bool *  unalloc 
)

Helper function to parse a cell.

XXX: finish documenting

◆ regfi_parse_classname()

uint8_t* regfi_parse_classname ( REGFI_FILE *  file,
uint32_t  offset,
uint16_t *  name_length,
uint32_t  max_size,
bool  strict 
)

Parses a classname cell.

XXX: finish documenting

◆ regfi_parse_data()

REGFI_BUFFER regfi_parse_data ( REGFI_FILE *  file,
uint32_t  offset,
uint32_t  length,
bool  strict 
)

Parses a single-cell data record.

XXX: finish documenting

◆ regfi_parse_little_data()

REGFI_BUFFER regfi_parse_little_data ( REGFI_FILE *  file,
uint32_t  voffset,
uint32_t  length,
bool  strict 
)

Parses a "little data" record which is stored entirely within the provided virtual offset.

XXX: finish documenting