Enum NtHiveNameString

pub enum NtHiveNameString<'h> {
    Latin1(&'h [u8]),
    Utf16LE(&'h [u8]),
}

Zero-copy representation of a key name or value name string stored in hive data. Can be either in Latin1 (ISO-8859-1) or UTF-16 (Little-Endian).

This allows to work with the string without performing any allocations or conversions. If the alloc feature is enabled, to_string_checked and to_string_lossy can be used to to retrieve a String.

Variants

Latin1(&'h [u8])

A byte stream where each byte is a single character of the Latin1 (ISO-8859-1) character set. Each byte can simply be casted to a char (as Unicode is ordered the same as Latin1).

Utf16LE(&'h [u8])

A byte stream where every two bytes make up a UTF-16 code point in little-endian order. Use u16::from_le_bytes and char::decode_utf16 if you want to get a stream of chars.

Implementations

impl<'h> NtHiveNameString<'h>

pub const fn is_empty(&self) -> bool

Returns true if self has a length of zero bytes.

pub const fn len(&self) -> usize

Returns the length of self.

This length is in bytes, not characters! In other words, it may not be what a human considers the length of the string.

pub fn to_string_checked(&self) -> Option<String>

Attempts to convert self to an owned String. Returns Some(String) if all characters could be converted successfully or None if a decoding error occurred.

pub fn to_string_lossy(&self) -> String

Converts self to an owned String, replacing invalid data with the replacement character (U+FFFD).

Examples found in repository

examples/readhive.rs (line 33)

fn main() -> Result<(), String> {
    // Parse arguments.
    let args: Vec<String> = env::args().collect();
    if args.len() < 2 {
        println!("Usage: readhive <FILENAME>");
        return Ok(());
    }

    // Read the hive file.
    let filename = &args[1];
    let mut f = File::open(filename).map_err(|e| format!("Error opening hive file: {e}"))?;
    let mut buffer = Vec::<u8>::new();
    f.read_to_end(&mut buffer)
        .map_err(|e| format!("Error reading hive file: {e}"))?;

    // Parse the hive.
    let hive = Hive::new(buffer.as_ref()).map_err(|e| format!("Error parsing hive file: {e}"))?;

    // Print the name of the root key node.
    let root_key = hive
        .root_key_node()
        .map_err(|e| format!("Error getting root key: {e}"))?;
    println!("{}", root_key.name().unwrap().to_string_lossy());

    process_subkey(root_key, 0)?;

    Ok(())
}

fn process_subkey<B>(key_node: KeyNode<B>, level: usize) -> Result<(), String>
where
    B: SplitByteSlice,
{
    // Print the names of subkeys of this node.
    if let Some(subkeys) = key_node.subkeys() {
        let subkeys = subkeys.map_err(|e| format!("Error getting subkeys: {e}"))?;

        for key_node in subkeys {
            let key_node = key_node.map_err(|e| format!("Error enumerating key: {e}"))?;
            let key_name = key_node
                .name()
                .map_err(|e| format!("Error getting key name: {e}"))?;

            print_indentation(level);
            println!("● {key_name}");

            if let Some(class_name) = key_node.class_name() {
                let class_name =
                    class_name.map_err(|e| format!("Error getting class name: {e}"))?;
                print_indentation(level);
                println!("  Class Name: {class_name}");
            }

            // Print the names of the values of this node.
            if let Some(value_iter) = key_node.values() {
                let value_iter =
                    value_iter.map_err(|e| format!("Error creating value iterator: {e}"))?;

                for value in value_iter {
                    let value = value.map_err(|e| format!("Error enumerating value: {e}"))?;

                    let mut value_name = value
                        .name()
                        .map_err(|e| format!("Error getting value name: {e}"))?
                        .to_string_lossy();
                    if value_name.is_empty() {
                        value_name.push_str("(Default)");
                    }

                    let value_type = value
                        .data_type()
                        .map_err(|e| format!("Error getting value type: {e}"))?;

                    let data_size = value.data_size();

                    // First line: Value Name, Data Type, and Data Size
                    print_indentation(level);
                    println!("  ○ {value_name} - {value_type:?} - {data_size}");

                    // Second line: The actual Value Data
                    print_indentation(level);
                    print!("    ");

                    match value_type {
                        KeyValueDataType::RegSZ | KeyValueDataType::RegExpandSZ => {
                            let string_data = value
                                .string_data()
                                .map_err(|e| format!("Error getting string data: {e}"))?;
                            println!("{string_data}")
                        }
                        KeyValueDataType::RegBinary => {
                            let binary_data = value
                                .data()
                                .map_err(|e| format!("Error getting binary data: {e}"))?;
                            match binary_data {
                                KeyValueData::Small(data) => println!("{data:?}"),
                                KeyValueData::Big(_iter) => println!("BIG DATA"),
                            }
                        }
                        KeyValueDataType::RegDWord | KeyValueDataType::RegDWordBigEndian => {
                            let dword_data = value
                                .dword_data()
                                .map_err(|e| format!("Error getting DWORD data: {e}"))?;
                            println!("{dword_data}")
                        }
                        KeyValueDataType::RegMultiSZ => {
                            let multi_string_data = value
                                .multi_string_data()
                                .map_err(|e| format!("Error getting multi string data: {e}"))?
                                .collect::<Result<Vec<_>>>()
                                .map_err(|e| {
                                    format!("Error getting multi string element data: {e}")
                                })?;
                            println!("{multi_string_data:?}")
                        }
                        KeyValueDataType::RegQWord => {
                            let qword_data = value
                                .qword_data()
                                .map_err(|e| format!("Error getting QWORD data: {e}"))?;
                            println!("{qword_data}")
                        }
                        _ => println!(),
                    }
                }
            }

            // Process subkeys.
            process_subkey(key_node, level + 1)?;
        }
    }

    Ok(())
}

Trait Implementations

impl<'h> Clone for NtHiveNameString<'h>

fn clone(&self) -> NtHiveNameString<'h>

Returns a duplicate of the value.

const fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'h> Debug for NtHiveNameString<'h>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for NtHiveNameString<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for NtHiveNameString<'_>

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq<&str> for NtHiveNameString<'_>

fn eq(&self, other: &&str) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'h> PartialEq<NtHiveNameString<'h>> for &str

fn eq(&self, other: &NtHiveNameString<'h>) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'h> PartialEq<NtHiveNameString<'h>> for str

fn eq(&self, other: &NtHiveNameString<'h>) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<str> for NtHiveNameString<'_>

fn eq(&self, other: &str) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq for NtHiveNameString<'_>

fn eq(&self, other: &Self) -> bool

Checks that two strings are a case-insensitive match (according to Windows’ definition of case-insensitivity, which only considers the Unicode Basic Multilingual Plane).

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd<&str> for NtHiveNameString<'_>

fn partial_cmp(&self, other: &&str) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl<'h> PartialOrd<NtHiveNameString<'h>> for &str

fn partial_cmp(&self, other: &NtHiveNameString<'h>) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl<'h> PartialOrd<NtHiveNameString<'h>> for str

fn partial_cmp(&self, other: &NtHiveNameString<'h>) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl PartialOrd<str> for NtHiveNameString<'_>

fn partial_cmp(&self, other: &str) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl PartialOrd for NtHiveNameString<'_>

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl<'h> Eq for NtHiveNameString<'h>