Struct KeyNode 

pub struct KeyNode {

    pub signature: [u8; 2],
    pub flags: u16,
    pub last_written: u64,
    pub access_bits: u8,
    pub layered_key_flags: u8,
    pub access_spare: u16,
    pub parent: u32,
    pub num_subkeys: u32,
    pub num_volatile_subkeys: u32,
    pub subkeys_list_offset: u32,
    pub volatile_subkeys_list_offset: u32,
    pub num_values: u32,
    pub values_list_offset: u32,
    pub security_offset: u32,
    pub class_name_offset: u32,
    pub largest_subkey_name_length: u16,
    pub virtualization_flags: u8,
    pub user_flags: u8,
    pub debug: u8,
    pub largest_subkey_class_name_length: u32,
    pub largest_value_name_length: u32,
    pub largest_value_data_size: u32,
    pub work_var: u32,
    pub key_name_length: u16,
    pub class_name_length: u16,
    pub key_name: Vec<u8>,
}

Key node structure (nk).

Fields

signature: [u8; 2]

Signature: “nk”

flags: u16

Flags.

last_written: u64

Last written timestamp (FILETIME).

access_bits: u8

Access bits (byte 0, Windows 8+).

layered_key_flags: u8

Layered key bit fields (byte 1, Windows 10 RS1+).

access_spare: u16

Spare bytes (bytes 2-3).

parent: u32

Offset of parent key node.

num_subkeys: u32

Number of subkeys.

num_volatile_subkeys: u32

Number of volatile subkeys.

subkeys_list_offset: u32

Offset of subkeys list.

volatile_subkeys_list_offset: u32

Offset of volatile subkeys list (no meaning on disk).

num_values: u32

Number of key values.

values_list_offset: u32

Offset of key values list.

security_offset: u32

Offset of key security item.

class_name_offset: u32

Offset of class name.

largest_subkey_name_length: u16

Largest subkey name length (in bytes, as UTF-16).

virtualization_flags: u8

Virtualization control flags (4 bits).

user_flags: u8

User flags / Wow64 flags (4 bits).

debug: u8

Debug field.

largest_subkey_class_name_length: u32

Largest subkey class name length.

largest_value_name_length: u32

Largest value name length (in bytes, as UTF-16).

largest_value_data_size: u32

Largest value data size.

work_var: u32

WorkVar (cached index, not used since Windows XP).

key_name_length: u16

Key name length in bytes.

class_name_length: u16

Class name length in bytes.

key_name: Vec<u8>

Key name (ASCII or UTF-16 depending on KEY_COMP_NAME flag).

Implementations

impl KeyNode

pub const FIXED_SIZE: usize = 76

Size of the fixed part of the key node (excluding name).

pub fn parse(data: &[u8]) -> Result<Self>

Parse a key node from a byte slice.

pub fn write<W: Write>(&self, writer: &mut W) -> Result<()>

Write the key node to a writer.

pub fn name(&self) -> String

Get the key name as a string.

pub fn set_name(&mut self, name: &str)

Set the key name.

pub fn get_flags(&self) -> KeyNodeFlags

Get the flags.

pub fn is_root(&self) -> bool

Check if this is the root key.

pub fn is_symlink(&self) -> bool

Check if this is a symlink.

pub fn has_subkeys(&self) -> bool

Check if this key has subkeys.

pub fn has_values(&self) -> bool

Check if this key has values.

pub fn get_access_bits(&self) -> AccessBits

Get the access bits.

pub fn get_layered_key_flags(&self) -> LayeredKeyFlags

Get the layered key flags (Windows 10 RS1+).

pub fn is_tombstone(&self) -> bool

Check if this is a tombstone key (layered keys feature).

pub fn get_debug_flags(&self) -> DebugFlags

Get the debug flags. These control breakpoints in checked Windows kernels when CmpRegDebugBreakEnabled is set.

pub fn get_user_flags(&self) -> UserFlags

Get the user flags (Wow64 flags).

pub fn get_virtualization_flags(&self) -> VirtualizationFlags

Get the virtualization control flags.

pub fn has_class_name(&self) -> bool

Check if this key has a class name.

pub fn is_predef_handle(&self) -> bool

Check if this key is a predefined handle. When true, the num_values field contains a handle instead of a value count.

pub fn get_predef_handle(&self) -> Option<u32>

Get the predefined handle value (if this is a predefined handle key). Returns None if KEY_PREDEF_HANDLE flag is not set.

pub fn new(name: &str, parent_offset: u32, is_root: bool) -> Self

Create a new key node.

pub fn total_size(&self) -> usize

Get the total size needed for this key node.

pub fn to_bytes(&self) -> Vec<u8>

Serialize to bytes.

Trait Implementations

impl Clone for KeyNode

fn clone(&self) -> KeyNode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyNode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.