Struct VmmRegHive 

pub struct VmmRegHive<'a> {
    pub va: u64,
    pub va_baseblock: u64,
    pub size: u32,
    pub name: String,
    pub name_short: String,
    pub path: String,
    /* private fields */
}

Registry Hive API.

The VmmRegHive info struct allows for access to the registry hive by exposed fields and various methods.

Created By

• vmm.reg_hive_list()

Examples

let hive_all = vmm.reg_hive_list()?;
for hive in hive_all {
    println!("{hive} size={} path={}", hive.size, hive.path);
}

Fields

va: u64

va_baseblock: u64

size: u32

name: String

name_short: String

path: String

Implementations

impl VmmRegHive<'_>

pub fn reg_hive_read( &self, ra: u32, size: usize, flags: u64, ) -> ResultEx<Vec<u8>>

Read registry hive data.

Arguments

• ra - Registry hive address to start reading from.
• size - The number of bytes to read.
• flags - Any combination of FLAG_*.

Examples

if let Ok(data) = hive.reg_hive_read(0x1000, 0x100, FLAG_NOCACHE | FLAG_ZEROPAD_ON_FAIL) {
    println!("{:?}", data.hex_dump());
}

pub fn reg_hive_write(&self, ra: u32, data: &[u8]) -> ResultEx<()>

Write registry hive data.

Writing to registry hives is extemely unsafe and may lead to registry corruption and unusable systems. Use with extreme care!

Arguments

• ra - Registry hive address to start writing from.
• data - Byte data to write.

Examples

let data_to_write = [0x56u8, 0x4d, 0x4d, 0x52, 0x55, 0x53, 0x54].to_vec();
let _r = hive.reg_hive_write(0x1000, &data_to_write);

Trait Implementations

impl<'a> Clone for VmmRegHive<'a>

fn clone(&self) -> VmmRegHive<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for VmmRegHive<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VmmRegHive<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for VmmRegHive<'_>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.