registry

import "github.com/TheManticoreProject/Manticore/windows/registry"

Package registry holds network-independent helpers for working with the Windows registry as data: the REG_* value types, a typed Value carrying a REG_* type and its raw little-endian bytes, and (in the regfile sub-package) an encoder/decoder for the textual “.reg” export format produced by regedit and reg.exe.

Value mirrors the wire representation used by the remote registry protocol (MS-RRP): a type tag plus the data bytes exactly as stored. The decode helpers (String, Uint32, …) project the bytes per Type; the constructor helpers (StringValue, DwordValue, …) build the bytes. It is intentionally field-compatible with the ms_rrp RegistryValue type so callers can convert between the two with a one-line struct literal.

Index

• Constants
• type Value
  • func BinaryValue(b []byte) Value
  • func DwordValue(v uint32) Value
  • func ExpandStringValue(s string) Value
  • func MultiStringValue(items []string) Value
  • func NoneValue(b []byte) Value
  • func QwordValue(v uint64) Value
  • func StringValue(s string) Value
  • func (v Value) MultiString() []string
  • func (v Value) String() string
  • func (v Value) Uint32() (uint32, bool)
  • func (v Value) Uint64() (uint64, bool)

Constants

REG_* registry value types.

[MS-RRP] 2.2.9 / winreg REG_* constants. Values match the numeric type tags carried on the wire and written in “.reg” files (e.g. hex(b) is REG_QWORD = 11).

const (
    RegNone                     uint32 = 0  // REG_NONE
    RegSz                       uint32 = 1  // REG_SZ (UTF-16LE, NUL-terminated)
    RegExpandSz                 uint32 = 2  // REG_EXPAND_SZ
    RegBinary                   uint32 = 3  // REG_BINARY
    RegDword                    uint32 = 4  // REG_DWORD (little-endian)
    RegDwordBigEndian           uint32 = 5  // REG_DWORD_BIG_ENDIAN
    RegLink                     uint32 = 6  // REG_LINK
    RegMultiSz                  uint32 = 7  // REG_MULTI_SZ
    RegResourceList             uint32 = 8  // REG_RESOURCE_LIST
    RegFullResourceDescriptor   uint32 = 9  // REG_FULL_RESOURCE_DESCRIPTOR
    RegResourceRequirementsList uint32 = 10 // REG_RESOURCE_REQUIREMENTS_LIST
    RegQword                    uint32 = 11 // REG_QWORD (little-endian)
)

type Value

Value is a typed registry value: its REG_* type and its raw little-endian data bytes, exactly as carried on the wire and stored in the registry.

type Value struct {
    Type uint32
    Data []byte
}

func BinaryValue

func BinaryValue(b []byte) Value

BinaryValue builds a REG_BINARY value from raw bytes.

func DwordValue

func DwordValue(v uint32) Value

DwordValue builds a REG_DWORD value (little-endian).

func ExpandStringValue

func ExpandStringValue(s string) Value

ExpandStringValue builds a REG_EXPAND_SZ value from a Go string.

func MultiStringValue

func MultiStringValue(items []string) Value

MultiStringValue builds a REG_MULTI_SZ value: each string NUL-terminated, the block terminated by a final empty string.

func NoneValue

func NoneValue(b []byte) Value

NoneValue builds a REG_NONE value from raw bytes.

func QwordValue

func QwordValue(v uint64) Value

QwordValue builds a REG_QWORD value (little-endian).

func StringValue

func StringValue(s string) Value

StringValue builds a REG_SZ value from a Go string.

func (Value) MultiString

func (v Value) MultiString() []string

MultiString decodes a REG_MULTI_SZ: a sequence of UTF-16LE strings, each NUL-terminated, the whole terminated by an empty string. Empty trailing entries are dropped.

func (Value) String

func (v Value) String() string

String decodes REG_SZ / REG_EXPAND_SZ / REG_LINK as a UTF-16LE string (trailing NULs stripped). For other types it returns the empty string; use the type-specific helpers.

func (Value) Uint32

func (v Value) Uint32() (uint32, bool)

Uint32 decodes a REG_DWORD (little-endian). ok is false if the data is too short.

func (Value) Uint64

func (v Value) Uint64() (uint64, bool)

Uint64 decodes a REG_QWORD (little-endian). ok is false if the data is too short.