Struct nt_hive::Hive

pub struct Hive<B: ByteSlice> { /* fields omitted */ }

Root structure describing a registry hive.

Implementations

impl<B> Hive<B> where
    B: ByteSlice, 

pub fn new(bytes: B) -> Result<Self>

Creates a new Hive from any byte slice. Performs basic validation and rejects any invalid hive.

You may use Hive::without_validation if you want to accept hives that fail validation.

pub fn without_validation(bytes: B) -> Result<Self>

Creates a new Hive from any byte slice, without validating the header.

You may later validate the header via Hive::validate. This is a solution for accessing parts of hives that have not been fully flushed to disk (e.g. due to hibernation and mismatching sequence numbers).

pub fn major_version(&self) -> u32

Returns the major version of this hive.

The only known value is 1.

pub fn minor_version(&self) -> u32

Returns the minor version of this hive.

You can feed this value to HiveMinorVersion::n to find out whether this is a known version.

pub fn root_key_node(&self) -> Result<KeyNode<&Self, B>>

Returns the root KeyNode of this hive.

pub fn validate(&self) -> Result<()>

Performs basic validations on the header of this hive.

If you read the hive via Hive::new, these validations have already been performed. This function is only relevant for hives opened via Hive::without_validation.

impl<B> Hive<B> where
    B: ByteSliceMut, 

pub fn clear_volatile_subkeys(&mut self) -> Result<()>

Clears the volatile_subkey_count field of all key nodes recursively.

This needs to be done before passing the hive to an NT kernel during boot. See https://github.com/reactos/reactos/pull/1883 for more information.