The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

regf

import "github.com/TheManticoreProject/Manticore/windows/registry/regf"

Package regf implements a read-only parser for Windows registry hive files in the REGF binary format. It supports offline parsing of SAM, SYSTEM, SECURITY, and other hive files for credential extraction and forensic analysis.

References:

Index

Constants

Key node flags.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#key-node

const (
    KeyVolatile   uint16 = 0x0001
    KeyHiveExit   uint16 = 0x0002
    KeyHiveEntry  uint16 = 0x0004
    KeyNoDelete   uint16 = 0x0008
    KeySymLink    uint16 = 0x0010
    KeyCompName   uint16 = 0x0020
    KeyPredefHndl uint16 = 0x0040
)

Value data types.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#key-value

const (
    RegNone                     uint32 = 0x00000000
    RegSz                       uint32 = 0x00000001
    RegExpandSz                 uint32 = 0x00000002
    RegBinary                   uint32 = 0x00000003
    RegDword                    uint32 = 0x00000004
    RegDwordBigEndian           uint32 = 0x00000005
    RegLink                     uint32 = 0x00000006
    RegMultiSz                  uint32 = 0x00000007
    RegResourceList             uint32 = 0x00000008
    RegFullResourceDescriptor   uint32 = 0x00000009
    RegResourceRequirementsList uint32 = 0x0000000A
    RegQword                    uint32 = 0x0000000B
)

Value flags.

const (
    ValueCompName uint16 = 0x0001
)

func ReplayTransactionLog

func ReplayTransactionLog(hiveData, logData []byte) ([]byte, int, error)

ReplayTransactionLog applies a transaction log to a primary hive image and returns the recovered image plus the number of entries applied. It applies entries whose sequence numbers run contiguously from the hive’s secondary sequence number, stopping at the first gap (the standard recovery rule); each entry’s dirty pages are written at 4096+Offset, the image is grown if a page extends it, and the base block’s sequence numbers and hive-bins-data size are updated to reflect the applied state.

type BaseBlock

BaseBlock is the 4096-byte file header of a REGF hive file.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#base-block

type BaseBlock struct {
    // Signature (4 bytes): must be ASCII "regf" (0x66676572 little-endian).
    Signature uint32

    // PrimarySequenceNumber (4 bytes): incremented at the start of a write operation.
    PrimarySequenceNumber uint32

    // SecondarySequenceNumber (4 bytes): incremented at the end of a write operation.
    SecondarySequenceNumber uint32

    // LastWrittenTimestamp (8 bytes): FILETIME (UTC).
    LastWrittenTimestamp uint64

    // MajorVersion (4 bytes): always 1.
    MajorVersion uint32

    // MinorVersion (4 bytes): 3, 4, 5, or 6.
    MinorVersion uint32

    // FileType (4 bytes): 0 = primary file.
    FileType uint32

    // FileFormat (4 bytes): 1 = direct memory load.
    FileFormat uint32

    // RootCellOffset (4 bytes): offset of the root key node cell, relative from start of
    // hive bins data.
    RootCellOffset uint32

    // HiveBinsDataSize (4 bytes): total size of all hive bins data in bytes.
    HiveBinsDataSize uint32

    // ClusteringFactor (4 bytes): disk sector size / 512.
    ClusteringFactor uint32

    // FileName (64 bytes): UTF-16LE string, partial path of primary file.
    FileName [64]byte

    // Checksum (4 bytes): XOR-32 of first 508 bytes.
    Checksum uint32
}

func NewBaseBlock

func NewBaseBlock() *BaseBlock

NewBaseBlock creates a new empty BaseBlock.

func (*BaseBlock) Marshal

func (b *BaseBlock) Marshal() ([]byte, error)

Marshal serializes the BaseBlock to binary data.

Returns:

  • A byte slice of exactly 4096 bytes.
  • An error if serialization fails.

func (*BaseBlock) Unmarshal

func (b *BaseBlock) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a BaseBlock from binary data.

Parameters:

  • data ([]byte): at least 4096 bytes of raw hive file header.

Returns:

  • The number of bytes consumed.
  • An error if the data is too short or the signature is invalid.

type BigData

BigData is a parsed DB (big data) record. When a value’s data exceeds bigDataThreshold bytes, its KeyValue.DataOffset points to one of these instead of a single data cell; the record references a list of data-segment cells that, concatenated, form the value data.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#big-data

type BigData struct {
    // Signature (2 bytes): must be ASCII "db" (0x6264 little-endian).
    Signature uint16

    // NumberOfSegments (2 bytes): count of data segments.
    NumberOfSegments uint16

    // SegmentsListOffset (4 bytes): offset to a cell holding NumberOfSegments 4-byte
    // offsets, each pointing to a data-segment cell.
    SegmentsListOffset uint32
}

func NewBigData

func NewBigData() *BigData

NewBigData creates a new empty BigData.

func (*BigData) Marshal

func (d *BigData) Marshal() ([]byte, error)

Marshal serializes the BigData record to binary data.

Returns:

  • A byte slice of exactly 8 bytes.
  • An error if serialization fails.

func (*BigData) Unmarshal

func (d *BigData) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a BigData record from cell data.

Parameters:

  • data ([]byte): cell data starting with the “db” signature.

Returns:

  • The number of bytes consumed (always 8).
  • An error if the data is too short or the signature is invalid.

type DirtyPageReference

DirtyPageReference locates one dirty page within a log entry: Offset is relative to the start of the primary hive’s hive-bins data (absolute file position = 4096 + Offset) and Size is the page length in bytes.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#dirty-pages-references

type DirtyPageReference struct {
    Offset uint32
    Size   uint32
}

type Hive

Hive represents an opened offline Windows registry hive file. The zero value is not usable; create one with Open or OpenBytes.

type Hive struct {
    // contains filtered or unexported fields
}

func Open

func Open(path string) (*Hive, error)

Open opens and parses a registry hive file from disk.

Parameters:

  • path (string): filesystem path to the hive file.

Returns:

  • A parsed Hive ready for queries.
  • An error if the file cannot be read or has an invalid format.

func OpenBytes

func OpenBytes(data []byte) (*Hive, error)

OpenBytes parses a registry hive from an in-memory byte slice.

Parameters:

  • data ([]byte): raw hive file content.

Returns:

  • A parsed Hive ready for queries.
  • An error if the data has an invalid format.

func OpenWithLogs

func OpenWithLogs(hivePath string, logPaths ...string) (*Hive, error)

OpenWithLogs opens a primary hive and replays the given transaction logs (in order, typically .LOG1 then .LOG2) before parsing, returning a Hive that reflects the recovered state. With no log paths it is equivalent to Open.

func (*Hive) BaseBlock

func (h *Hive) BaseBlock() *BaseBlock

BaseBlock returns the parsed file header.

func (*Hive) Bytes

func (h *Hive) Bytes() ([]byte, error)

Bytes finalizes the hive (sequence numbers and checksum) and returns a copy of the current image, suitable for writing to disk or re-opening with OpenBytes.

func (*Hive) Close

func (h *Hive) Close() error

Close releases the hive data. The Hive is not usable after Close.

func (*Hive) CreateKey

func (h *Hive) CreateKey(parentPath, name string) error

CreateKey creates an empty subkey `name` under the key at parentPath. The new key inherits the parent’s security descriptor (sharing its SK record). It errors if the parent does not exist, the subkey already exists, or the parent’s subkey list is an index root (ri). The change is applied in memory; call Bytes or Save to finalize.

func (*Hive) DeleteKey

func (h *Hive) DeleteKey(parentPath, name string) error

DeleteKey removes the subkey `name` under parentPath and everything beneath it (recursively freeing descendant keys, values, and their cells). It errors if the key is not found or the parent’s subkey list is an index root (ri).

func (*Hive) DeleteValue

func (h *Hive) DeleteValue(keyPath, name string) error

DeleteValue removes a named value from the key at keyPath, freeing its cells. It returns an error if the key or value does not exist.

func (*Hive) EnumKey

func (h *Hive) EnumKey(path string) ([]string, error)

EnumKey returns the names of all subkeys under the given path.

Parameters:

  • path (string): key path relative to the root key.

Returns:

  • A slice of subkey names.
  • An error if the key is not found.

func (*Hive) EnumValues

func (h *Hive) EnumValues(path string) ([]string, error)

EnumValues returns all value names under the given key path.

Parameters:

  • path (string): key path relative to the root key.

Returns:

  • A slice of value names (empty string for the default value).
  • An error if the key is not found.

func (*Hive) FindKey

func (h *Hive) FindKey(path string) (*KeyNode, error)

FindKey locates a registry key by path relative to the root key. Path components are separated by backslashes. A leading backslash is optional.

Parameters:

  • path (string): key path, e.g. “SAM\\Domains\\Account” or “ControlSet001\\Control\\Lsa\\JD”.

Returns:

  • The KeyNode at the given path.
  • An error if any component is not found.

func (*Hive) GetClass

func (h *Hive) GetClass(keyPath string) ([]byte, error)

GetClass reads the class data for the key at the given path.

Parameters:

  • keyPath (string): key path relative to the root key.

Returns:

  • The raw class data bytes.
  • An error if the key is not found or has no class data.

func (*Hive) GetSecurity

func (h *Hive) GetSecurity(keyPath string) ([]byte, error)

GetSecurity reads the self-relative SECURITY_DESCRIPTOR for the key at the given path.

Parameters:

  • keyPath (string): key path relative to the root key.

Returns:

  • The raw security descriptor bytes, or nil if the key has no SK record.
  • An error if the key is not found or the SK record cannot be read.

func (*Hive) GetSecurityDescriptor

func (h *Hive) GetSecurityDescriptor(keyPath string) (*securitydescriptor.NtSecurityDescriptor, error)

GetSecurityDescriptor decodes the SECURITY_DESCRIPTOR of the key at the given path into a winacl NtSecurityDescriptor.

Parameters:

  • keyPath (string): key path relative to the root key.

Returns:

  • The parsed security descriptor, or nil if the key has no SK record.
  • An error if the key is not found or the descriptor cannot be parsed.

func (*Hive) GetValue

func (h *Hive) GetValue(keyPath, valueName string) (uint32, []byte, error)

GetValue reads a named value from the key at the given path.

Parameters:

  • keyPath (string): key path relative to the root key.
  • valueName (string): value name; empty string for the default value.

Returns:

  • The data type (REG_* constant).
  • The raw value data bytes.
  • An error if the key or value is not found.

func (*Hive) RecoverDeletedKeys

func (h *Hive) RecoverDeletedKeys() ([]*KeyNode, error)

RecoverDeletedKeys scans the hive’s unallocated (free) cells for key-node (NK) records that survived deletion and returns them. A deleted key is one whose cell was freed (its size prefix flipped positive) but whose bytes have not yet been overwritten.

The returned KeyNodes are attached to the hive so Name and the other field accessors work, but navigation from them (SubKeys, Values) is unreliable: a deleted key’s child list and value offsets may point at cells that have since been reallocated. Treat the result as recovered metadata, not as live tree nodes.

func (*Hive) RecoverDeletedValues

func (h *Hive) RecoverDeletedValues() ([]*KeyValue, error)

RecoverDeletedValues scans the hive’s unallocated (free) cells for value (VK) records that survived deletion and returns them. As with RecoverDeletedKeys, treat these as recovered metadata; a recovered value’s external data cell may have been reallocated, so Data may return stale or unrelated bytes (inline values are self-contained and safe).

func (*Hive) RootKey

func (h *Hive) RootKey() (*KeyNode, error)

RootKey returns the root KeyNode of the hive.

Returns:

  • The root KeyNode.
  • An error if the root cell cannot be read.

func (*Hive) Save

func (h *Hive) Save(path string) error

Save finalizes the hive and writes it to path.

func (*Hive) SetValue

func (h *Hive) SetValue(keyPath, name string, dataType uint32, data []byte) error

SetValue creates or replaces a value on the key at keyPath. data is stored inline when it is 4 bytes or smaller, otherwise in its own data cell. The value name is stored as a compressed (Latin-1) string. The change is applied to the in-memory image; call Bytes or Save to obtain the finalized hive.

type HiveBin

HiveBin is the 32-byte header of a hive bin block. Each hive bin contains cells and is a multiple of 4096 bytes in size.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#hive-bin

type HiveBin struct {
    // Signature (4 bytes): must be ASCII "hbin" (0x6E696268 little-endian).
    Signature uint32

    // Offset (4 bytes): offset of this hive bin from start of hive bins data.
    Offset uint32

    // Size (4 bytes): total size of this hive bin including header, multiple of 4096.
    Size uint32

    // Reserved (8 bytes): unused.
    Reserved uint64

    // Timestamp (8 bytes): FILETIME (UTC); only meaningful for the first hive bin.
    Timestamp uint64

    // Spare (4 bytes): memory allocation field, no disk meaning.
    Spare uint32
}

func NewHiveBin

func NewHiveBin() *HiveBin

NewHiveBin creates a new empty HiveBin.

func (*HiveBin) Marshal

func (h *HiveBin) Marshal() ([]byte, error)

Marshal serializes the HiveBin header to binary data.

Returns:

  • A byte slice of exactly 32 bytes.
  • An error if serialization fails.

func (*HiveBin) Unmarshal

func (h *HiveBin) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a HiveBin header from binary data.

Parameters:

  • data ([]byte): at least 32 bytes of raw hive bin header.

Returns:

  • The number of bytes consumed (always 32).
  • An error if the data is too short or the signature is invalid.

type KeyNode

KeyNode is a parsed NK (key node) record representing a registry key.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#key-node

type KeyNode struct {
    // Signature (2 bytes): must be ASCII "nk" (0x6B6E little-endian).
    Signature uint16

    // Flags (2 bytes): bit mask of key flags.
    Flags uint16

    // LastWrittenTimestamp (8 bytes): FILETIME (UTC).
    LastWrittenTimestamp uint64

    // AccessBits (4 bytes): access tracking (Win10 RS1+); otherwise spare.
    AccessBits uint32

    // Parent (4 bytes): offset to parent key node.
    Parent uint32

    // NumberOfSubKeys (4 bytes): count of stable (non-volatile) subkeys.
    NumberOfSubKeys uint32

    // NumberOfVolatileSubKeys (4 bytes): count of volatile subkeys (no disk meaning).
    NumberOfVolatileSubKeys uint32

    // SubKeysListOffset (4 bytes): offset to subkey list (lf/lh/li/ri), or 0xFFFFFFFF.
    SubKeysListOffset uint32

    // VolatileSubKeysListOffset (4 bytes): no disk meaning.
    VolatileSubKeysListOffset uint32

    // NumberOfValues (4 bytes): count of values under this key.
    NumberOfValues uint32

    // ValuesListOffset (4 bytes): offset to values list, or 0xFFFFFFFF.
    ValuesListOffset uint32

    // SecurityOffset (4 bytes): offset to sk record.
    SecurityOffset uint32

    // ClassNameOffset (4 bytes): offset to cell containing class name data, or 0xFFFFFFFF.
    ClassNameOffset uint32

    // MaxSubKeyNameLength (4 bytes): largest subkey name length (with user/debug flags).
    MaxSubKeyNameLength uint32

    // MaxSubKeyClassNameLength (4 bytes): largest subkey class name length.
    MaxSubKeyClassNameLength uint32

    // MaxValueNameLength (4 bytes): largest value name length.
    MaxValueNameLength uint32

    // MaxValueDataSize (4 bytes): largest value data size.
    MaxValueDataSize uint32

    // WorkVar (4 bytes): cached subkey index (Win2000 only).
    WorkVar uint32

    // KeyNameLength (2 bytes): length of key name in bytes.
    KeyNameLength uint16

    // ClassNameLength (2 bytes): length of class name in bytes.
    ClassNameLength uint16

    // KeyNameRaw (variable): raw key name bytes.
    KeyNameRaw []byte
    // contains filtered or unexported fields
}

func NewKeyNode

func NewKeyNode() *KeyNode

NewKeyNode creates a new empty KeyNode.

func (*KeyNode) ClassData

func (k *KeyNode) ClassData() ([]byte, error)

ClassData returns the class data bytes for this key, or nil if not set.

func (*KeyNode) IsRoot

func (k *KeyNode) IsRoot() bool

IsRoot reports whether this key is a root key (KEY_HIVE_ENTRY flag set).

func (*KeyNode) Marshal

func (k *KeyNode) Marshal() ([]byte, error)

Marshal serializes the KeyNode to binary data.

Returns:

  • A byte slice containing the serialized KeyNode.
  • An error if serialization fails.

func (*KeyNode) Name

func (k *KeyNode) Name() string

Name returns the decoded key name as a Go string.

func (*KeyNode) SecurityDescriptor

func (k *KeyNode) SecurityDescriptor() ([]byte, error)

SecurityDescriptor returns the self-relative SECURITY_DESCRIPTOR bytes for this key from its SK record, or nil if the key references no security record.

func (*KeyNode) SecurityDescriptorParsed

func (k *KeyNode) SecurityDescriptorParsed() (*securitydescriptor.NtSecurityDescriptor, error)

SecurityDescriptorParsed decodes this key’s SK record into a winacl NtSecurityDescriptor (owner, group, DACL, SACL). It returns nil (no error) when the key references no SK record. Use the raw SecurityDescriptor accessor instead when only the undecoded bytes are needed.

func (*KeyNode) SubKeys

func (k *KeyNode) SubKeys() ([]*KeyNode, error)

SubKeys returns all subkey KeyNodes under this key.

func (*KeyNode) Unmarshal

func (k *KeyNode) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a KeyNode from cell data (after the 4-byte cell size prefix).

Parameters:

  • data ([]byte): cell data starting with the “nk” signature.

Returns:

  • The number of bytes consumed.
  • An error if the data is too short or the signature is invalid.

func (*KeyNode) Value

func (k *KeyNode) Value(name string) (*KeyValue, error)

Value returns the named value under this key, or an error if not found.

func (*KeyNode) Values

func (k *KeyNode) Values() ([]*KeyValue, error)

Values returns all KeyValue records under this key.

type KeyValue

KeyValue is a parsed VK (value key) record representing a registry value.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#key-value

type KeyValue struct {
    // Signature (2 bytes): must be ASCII "vk" (0x6B76 little-endian).
    Signature uint16

    // NameLength (2 bytes): length of value name in bytes; 0 = default (unnamed) value.
    NameLength uint16

    // DataSize (4 bytes): data size. Bit 31 set means inline data.
    DataSize uint32

    // DataOffset (4 bytes): offset to data cell, or inline data when bit 31 of DataSize is set.
    DataOffset uint32

    // DataType (4 bytes): REG_* data type constant.
    DataType uint32

    // Flags (2 bytes): VALUE_COMP_NAME etc.
    Flags uint16

    // Spare (2 bytes): unused.
    Spare uint16

    // NameRaw (variable): raw value name bytes.
    NameRaw []byte
    // contains filtered or unexported fields
}

func NewKeyValue

func NewKeyValue() *KeyValue

NewKeyValue creates a new empty KeyValue.

func (*KeyValue) ActualDataSize

func (v *KeyValue) ActualDataSize() uint32

ActualDataSize returns the data size with the inline flag masked off.

func (*KeyValue) Data

func (v *KeyValue) Data() ([]byte, error)

Data returns the raw data bytes for this value.

func (*KeyValue) IsInline

func (v *KeyValue) IsInline() bool

IsInline reports whether the value data is stored inline in the DataOffset field.

func (*KeyValue) Marshal

func (v *KeyValue) Marshal() ([]byte, error)

Marshal serializes the KeyValue to binary data.

Returns:

  • A byte slice containing the serialized KeyValue.
  • An error if serialization fails.

func (*KeyValue) Name

func (v *KeyValue) Name() string

Name returns the decoded value name as a Go string. Returns "" for the default value.

func (*KeyValue) String

func (v *KeyValue) String() string

String decodes the value data as a string for REG_SZ / REG_EXPAND_SZ types.

func (*KeyValue) Type

func (v *KeyValue) Type() uint32

Type returns the REG_* data type.

func (*KeyValue) Uint32

func (v *KeyValue) Uint32() (uint32, bool)

Uint32 decodes a REG_DWORD value. Returns (0, false) if not applicable.

func (*KeyValue) Unmarshal

func (v *KeyValue) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a KeyValue from cell data.

Parameters:

  • data ([]byte): cell data starting with the “vk” signature.

Returns:

  • The number of bytes consumed.
  • An error if the data is too short or the signature is invalid.

type LogEntry

LogEntry is a parsed HvLE transaction-log entry: a single logged transaction carrying a set of dirty pages to be written back into the primary hive during recovery.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#log-entry

type LogEntry struct {
    // Signature (4 bytes): must be ASCII "HvLE" (0x454C7648 little-endian).
    Signature uint32

    // LogSize (4 bytes): total size of this log entry including header and page data,
    // aligned to 512 bytes.
    LogSize uint32

    // Flags (4 bytes): log-entry flags.
    Flags uint32

    // SequenceNumber (4 bytes): the sequence number this entry advances the hive to.
    SequenceNumber uint32

    // HiveBinsDataSize (4 bytes): hive-bins data size after this entry is applied.
    HiveBinsDataSize uint32

    // DirtyPagesCount (4 bytes): number of dirty pages in this entry.
    DirtyPagesCount uint32

    // Hash1 (8 bytes): Marvin64 hash of the dirty-page data (not verified here).
    Hash1 uint64

    // Hash2 (8 bytes): Marvin64 hash of the entry header (not verified here).
    Hash2 uint64

    // DirtyPages are the page references; PageData holds the corresponding page bytes in
    // the same order.
    DirtyPages []DirtyPageReference
    PageData   [][]byte
}

func NewLogEntry

func NewLogEntry() *LogEntry

NewLogEntry creates a new empty LogEntry.

func (*LogEntry) Marshal

func (e *LogEntry) Marshal() ([]byte, error)

Marshal serializes the LogEntry: header, dirty-page references, page data, then zero padding up to LogSize. DirtyPagesCount and LogSize must be set consistently with DirtyPages/PageData.

func (*LogEntry) Unmarshal

func (e *LogEntry) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a LogEntry from data starting at its “HvLE” signature.

Returns:

  • The number of bytes consumed (the entry’s LogSize, so the caller can advance to the next entry).
  • An error if the data is too short, the signature is invalid, or a referenced page runs past the buffer.

type SecurityKey

SecurityKey is a parsed SK (key security) record. Multiple key nodes can share one SK record (it is reference-counted); a KeyNode reaches its SK record through SecurityOffset.

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#key-security

type SecurityKey struct {
    // Signature (2 bytes): must be ASCII "sk" (0x6B73 little-endian).
    Signature uint16

    // Reserved (2 bytes): unused.
    Reserved uint16

    // Flink (4 bytes): offset of the next sk record in the circular list.
    Flink uint32

    // Blink (4 bytes): offset of the previous sk record in the circular list.
    Blink uint32

    // ReferenceCount (4 bytes): number of key nodes referencing this record.
    ReferenceCount uint32

    // SecurityDescriptorSize (4 bytes): size in bytes of the embedded security descriptor.
    SecurityDescriptorSize uint32

    // SecurityDescriptor (variable): self-relative SECURITY_DESCRIPTOR blob ([MS-DTYP] 2.4.6).
    SecurityDescriptor []byte
}

func NewSecurityKey

func NewSecurityKey() *SecurityKey

NewSecurityKey creates a new empty SecurityKey.

func (*SecurityKey) Marshal

func (s *SecurityKey) Marshal() ([]byte, error)

Marshal serializes the SecurityKey to binary data.

Returns:

  • A byte slice containing the serialized SecurityKey.
  • An error if serialization fails.

func (*SecurityKey) Unmarshal

func (s *SecurityKey) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a SecurityKey from cell data (after the 4-byte cell size prefix).

Parameters:

  • data ([]byte): cell data starting with the “sk” signature.

Returns:

  • The number of bytes consumed.
  • An error if the data is too short or the signature is invalid.

type SubKeyList

SubKeyList is the internal representation of a parsed subkey list record (LF, LH, LI, or RI).

Source: https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md#subkeys-list

type SubKeyList struct {
    // Signature (2 bytes): "lf", "lh", "ri", or "li".
    Signature uint16

    // NumberOfElements (2 bytes): count of entries.
    NumberOfElements uint16

    // Elements contains the raw element data, interpreted per signature type.
    Elements []byte
}

func NewSubKeyList

func NewSubKeyList() *SubKeyList

NewSubKeyList creates a new empty SubKeyList.

func (*SubKeyList) IsIndexRoot

func (s *SubKeyList) IsIndexRoot() bool

IsIndexRoot reports whether this is an RI (index root) list, which contains references to other sublists rather than directly to key nodes.

func (*SubKeyList) KeyNodeOffsets

func (s *SubKeyList) KeyNodeOffsets() []uint32

KeyNodeOffsets returns the offsets to all key nodes referenced by this list. For RI lists, it returns the offsets to the sublists (not the key nodes themselves); the caller must recurse into each sublist.

func (*SubKeyList) Marshal

func (s *SubKeyList) Marshal() ([]byte, error)

Marshal serializes the SubKeyList to binary data.

Returns:

  • A byte slice containing the serialized SubKeyList.
  • An error if serialization fails.

func (*SubKeyList) Unmarshal

func (s *SubKeyList) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a SubKeyList from cell data.

Parameters:

  • data ([]byte): cell data starting with the list signature.

Returns:

  • The number of bytes consumed.
  • An error if the data is too short or the signature is unrecognized.

type TransactionLog

TransactionLog is a parsed transaction-log file: the sequence of HvLE entries that follow the 512-byte log header.

type TransactionLog struct {
    Entries []*LogEntry
}

func (*TransactionLog) Unmarshal

func (t *TransactionLog) Unmarshal(data []byte) error

Unmarshal parses the HvLE entries from a transaction-log file’s bytes. Parsing stops at the first non-HvLE object (a malformed or empty trailing entry), which is normal: a log file commonly contains stale space after its last valid entry.