Enum dfir_toolkit::registry::types::KeyValueData

pub enum KeyValueData {
    RegNone,
    RegSZ(String),
    RegExpandSZ(String),
    RegBinary(Vec<u8>),
    RegDWord(u32),
    RegDWordBigEndian(u32),
    RegLink(String),
    RegMultiSZ(Vec<String>),
    RegResourceList(String),
    RegFullResourceDescriptor(String),
    RegResourceRequirementsList(String),
    RegQWord(u64),
    RegFileTime(DateTime<Utc>),
}

Represents a binary registry datum

let mut reader = Cursor::new(b"Test\0");
let parsed_data: KeyValueData = reader.read_ne_args((KeyValueDataType::RegSZ, 5)).unwrap();
assert_eq!(parsed_data, KeyValueData::RegSZ("Test".to_string()));

Variants

RegNone

RegSZ(String)

RegExpandSZ(String)

RegBinary(Vec<u8>)

RegDWord(u32)

RegDWordBigEndian(u32)

RegLink(String)

RegMultiSZ(Vec<String>)

RegResourceList(String)

RegFullResourceDescriptor(String)

RegResourceRequirementsList(String)

RegQWord(u64)

RegFileTime(DateTime<Utc>)

Trait Implementations

impl BinRead for KeyValueData

type Args = (KeyValueDataType, u32)

The type of arguments needed to be supplied in order to read this type, usually a tuple.

fn read_options<R: Read + Seek>( reader: &mut R, options: &ReadOptions, args: Self::Args ) -> BinResult<Self>

Read the type from the reader

fn read<R>(reader: &mut R) -> Result<Self, Error>where R: Read + Seek,

Read the type from the reader while assuming no arguments have been passed

fn read_args<R>(reader: &mut R, args: Self::Args) -> Result<Self, Error>where R: Read + Seek,

Read the type from the reader using the specified arguments

fn after_parse<R>( &mut self, _: &mut R, _: &ReadOptions, _: Self::Args ) -> Result<(), Error>where R: Read + Seek,

fn args_default() -> Option<Self::Args>

The default arguments to be used when using the read shortcut method. Override this for any type that optionally requries arguments

impl Debug for KeyValueData

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for KeyValueData

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for KeyValueData

fn eq(&self, other: &KeyValueData) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for KeyValueData

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for KeyValueData

impl StructuralEq for KeyValueData

impl StructuralPartialEq for KeyValueData