regfile

import "github.com/TheManticoreProject/Manticore/windows/registry/regfile"

Package regfile encodes and decodes the textual “.reg” registry export format produced by regedit and reg.exe (the “Windows Registry Editor Version 5.00” / legacy “REGEDIT4” files).

It is pure, network-independent logic built on the registry.Value type: the encoder turns key/value blocks into the textual format, and the (tolerant) decoder parses real-world “.reg” files back into structured blocks. Together they let callers implement reg.exe-style EXPORT/IMPORT on top of any registry backend.

Index

• Constants
• func FormatDeleteValueLine(name string) string
• func FormatKeyHeader(path string, del bool) string
• func FormatValueLine(name string, v registry.Value) string
• func Marshal(blocks []KeyBlock) []byte
• type KeyBlock
  • func Parse(raw []byte) ([]KeyBlock, error)
• type ValueLine

Constants

Header is the first line of a version-5 (".reg" v5.00) file. It is written in UTF-16LE with a byte-order mark by Marshal.

const Header = "Windows Registry Editor Version 5.00"

func FormatDeleteValueLine

func FormatDeleteValueLine(name string) string

FormatDeleteValueLine returns the directive that deletes the named value: `“Name”=-` (or `@=-` for the default value).

func FormatKeyHeader

func FormatKeyHeader(path string, del bool) string

FormatKeyHeader returns the bracketed key line for path, e.g. “[HKEY_LOCAL_MACHINE\Software\Foo]”. When del is true it emits the delete directive “[-HKEY_LOCAL_MACHINE\Software\Foo]”. Backslashes in the path are not escaped (they are literal path separators).

func FormatValueLine

func FormatValueLine(name string, v registry.Value) string

FormatValueLine returns a single “.reg” value line for the named value, e.g. `“Name”=“data”` or `@=dword:0000001f` for the default value (name == “”). The data token is chosen from v.Type per the “.reg” type encodings.

func Marshal

func Marshal(blocks []KeyBlock) []byte

Marshal renders the blocks as a complete “.reg” file: the version-5 header, a blank line, then each key block (its header followed by one line per value). The result is UTF-16LE with a leading byte-order mark and CRLF line endings, exactly as regedit writes exports.

type KeyBlock

KeyBlock is a key and its values, as written between two key headers in a “.reg” file. Delete is true for a key-delete directive (`[-HKEY_…\Key]`), in which case Values is empty.

type KeyBlock struct {
    Path   string
    Delete bool
    Values []ValueLine
}

func Parse

func Parse(raw []byte) ([]KeyBlock, error)

Parse decodes a “.reg” file into its key blocks. It is tolerant of real-world inputs: it auto-detects UTF-16LE/UTF-16BE (with BOM) and UTF-8 (with or without BOM) encodings, accepts both the “Windows Registry Editor Version 5.00” and legacy “REGEDIT4” headers, ignores comment (";") and blank lines, folds backslash line-continuations in long hex values, and understands the delete directives “[-Key]” and `“Name”=-`.

Parsing is best-effort: lines that cannot be interpreted are skipped and the blocks parsed so far are still returned, with the per-line problems joined into the returned error. A nil error means every non-trivial line parsed.

type ValueLine

ValueLine is one value entry within a key block. Delete is true for a delete directive (`“Name”=-`), in which case Value is the zero Value. Name is empty for the default value (the “@” token).

type ValueLine struct {
    Name   string
    Value  registry.Value
    Delete bool
}