Struct VmmRegValue 

pub struct VmmRegValue<'a> {
    pub name: String,
    pub path: String,
    pub raw_type: u32,
    pub raw_size: u32,
    /* private fields */
}

Registry Value API.

The VmmRegValue info struct represents a registry value and also have additional access methods for parent key and the value itself.

Registry values may be addressed either by its full path or by hive address and hive path. Both addressing modes are shown in the examples below. Registry values are case sensitive.

Created By

• vmm.reg_value()
• vmmregkey.values()
• vmmregkey.values_map()

Examples

// Retrieve a REG_SZ (string) reg value by its full path.
let regpath = "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir";
let regvalue = vmm.reg_key(regpath)?
println!("{regvalue}");
if let Ok(VmmRegValueType::REG_SZ(s)) = regvalue.value() {
    println!("REG_SZ: {s}");
}

// Retrieve a REG_DWORD reg value using the hive path.
// (SOFTWARE hive example address: 0xffffba061a908000).
let regpath = "0xffffba061a908000\\ROOT\\Microsoft\\.NETFramework\\Enable64Bit";
let regvalue = vmm.reg_key(regpath)?
if let Ok(VmmRegValueType::REG_DWORD(dw)) = regvalue.value() {
    println!("REG_DWORD: 0x{:08x}", dw);
}

Fields

name: String

Value name.

path: String

Path including key name.

raw_type: u32

The raw type as specified by Windows REG_* constants.

raw_size: u32

The raw data size in bytes.

Implementations

impl VmmRegValue<'_>

pub fn parent(&self) -> ResultEx<VmmRegKey<'_>>

Retrieve the parent registry key.

Examples

let regkey_parent = regvalue.parent()?
println!("{regkey_parent");

pub fn value(&self) -> ResultEx<VmmRegValueType>

Retrieve the registry value.

The registry value is returned as VmmRegValueType enum containing the relevant embedded value.

Examples

// Retrieve a REG_SZ (string) reg value.
if let Ok(VmmRegValueType::REG_SZ(s)) = regvalue.value() {
    println!("REG_SZ: {s}");
}

// Retrieve a REG_DWORD reg value.
if let Ok(VmmRegValueType::REG_DWORD(dw)) = regvalue.value() {
    println!("REG_DWORD: 0x{:08x}", dw);
}

pub fn raw_value(&self) -> ResultEx<Vec<u8>>

Retrieve the raw value bytes backing the actual value.

Examples

let raw_value = vmmregvalue.raw_value()?;
println!("{:?}", raw_value.hex_dump());

Trait Implementations

impl<'a> Clone for VmmRegValue<'a>

fn clone(&self) -> VmmRegValue<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for VmmRegValue<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VmmRegValue<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for VmmRegValue<'_>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.