Struct Hive

pub struct Hive<B: SplitByteSlice> { /* private fields */ }

Root structure describing a registry hive.

Implementations

impl<B> Hive<B>

where B: SplitByteSlice,

pub fn new(bytes: B) -> Result<Self>

Creates a new Hive from any byte slice. Performs basic validation and rejects any invalid hive.

You may use Hive::without_validation if you want to accept hives that fail validation.

Examples found in repository

examples/readhive.rs (line 27)

fn main() -> Result<(), String> {
    // Parse arguments.
    let args: Vec<String> = env::args().collect();
    if args.len() < 2 {
        println!("Usage: readhive <FILENAME>");
        return Ok(());
    }

    // Read the hive file.
    let filename = &args[1];
    let mut f = File::open(filename).map_err(|e| format!("Error opening hive file: {e}"))?;
    let mut buffer = Vec::<u8>::new();
    f.read_to_end(&mut buffer)
        .map_err(|e| format!("Error reading hive file: {e}"))?;

    // Parse the hive.
    let hive = Hive::new(buffer.as_ref()).map_err(|e| format!("Error parsing hive file: {e}"))?;

    // Print the name of the root key node.
    let root_key = hive
        .root_key_node()
        .map_err(|e| format!("Error getting root key: {e}"))?;
    println!("{}", root_key.name().unwrap().to_string_lossy());

    process_subkey(root_key, 0)?;

    Ok(())
}

pub fn without_validation(bytes: B) -> Result<Self>

Creates a new Hive from any byte slice, without validating the header.

You may later validate the header via Hive::validate. This is a solution for accessing parts of hives that have not been fully flushed to disk (e.g. due to hibernation and mismatching sequence numbers).

pub fn major_version(&self) -> u32

Returns the major version of this hive.

The only known value is 1.

pub fn minor_version(&self) -> u32

Returns the minor version of this hive.

You can feed this value to HiveMinorVersion::n to find out whether this is a known version.

pub fn root_key_node(&self) -> Result<KeyNode<'_, B>>

Returns the root KeyNode of this hive.

Examples found in repository

examples/readhive.rs (line 31)

fn main() -> Result<(), String> {
    // Parse arguments.
    let args: Vec<String> = env::args().collect();
    if args.len() < 2 {
        println!("Usage: readhive <FILENAME>");
        return Ok(());
    }

    // Read the hive file.
    let filename = &args[1];
    let mut f = File::open(filename).map_err(|e| format!("Error opening hive file: {e}"))?;
    let mut buffer = Vec::<u8>::new();
    f.read_to_end(&mut buffer)
        .map_err(|e| format!("Error reading hive file: {e}"))?;

    // Parse the hive.
    let hive = Hive::new(buffer.as_ref()).map_err(|e| format!("Error parsing hive file: {e}"))?;

    // Print the name of the root key node.
    let root_key = hive
        .root_key_node()
        .map_err(|e| format!("Error getting root key: {e}"))?;
    println!("{}", root_key.name().unwrap().to_string_lossy());

    process_subkey(root_key, 0)?;

    Ok(())
}

pub fn validate(&self) -> Result<()>

Performs basic validations on the header of this hive.

If you read the hive via Hive::new, these validations have already been performed. This function is only relevant for hives opened via Hive::without_validation.

impl<B> Hive<B>

where B: SplitByteSliceMut,

pub fn clear_volatile_subkeys(&mut self) -> Result<()>

Clears the volatile_subkey_count field of all key nodes recursively.

This needs to be done before passing the hive to an NT kernel during boot. See https://github.com/reactos/reactos/pull/1883 for more information.