Struct WindowsKeyIndex 

pub struct WindowsKeyIndex<'a, Driver>
where
    Driver: VmiRead,
    <Driver as VmiDriver>::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

Available on crate feature os-windows only.

A subkey index cell of a registry key.

The Configuration Manager walks _CM_KEY_INDEX cells to enumerate a _CM_KEY_NODE’s children. Four variants share the same shape and are distinguished by the signature. il, fl, and hl are leaf lists. ir is a root index list whose entries point at leaf lists.

Implementation Details

Corresponds to _CM_KEY_INDEX.

Implementations

impl<'a, Driver> WindowsKeyIndex<'a, Driver>

where Driver: VmiRead, <Driver as VmiDriver>::Architecture: ArchAdapter<Driver>,

pub const INDEX_LEAF_SIGNATURE: u16 = 0x696c

Signature of a plain leaf list (il).

Each entry is a single HCELL_INDEX.

Implementation Details

Corresponds to CM_KEY_INDEX_LEAF.

pub const FAST_LEAF_SIGNATURE: u16 = 0x666c

Signature of a fast leaf list (fl).

Each entry pairs an HCELL_INDEX with a 4-byte name hint.

Implementation Details

Corresponds to CM_KEY_FAST_LEAF.

pub const HASH_LEAF_SIGNATURE: u16 = 0x686c

Signature of a hash leaf list (hl).

Each entry pairs an HCELL_INDEX with an NT name hash.

Implementation Details

Corresponds to CM_KEY_HASH_LEAF.

pub const INDEX_ROOT_SIGNATURE: u16 = 0x6972

Signature of a root index list (ir).

Each entry is an HCELL_INDEX pointing to a leaf list.

Implementation Details

Corresponds to CM_KEY_INDEX_ROOT.

pub fn new( vmi: VmiState<'a, WindowsOs<Driver>>, va: Va, ) -> WindowsKeyIndex<'a, Driver>

Creates a new key index.

pub fn signature(&self) -> Result<u16, VmiError>

Returns the signature of the index.

Implementation Details

Corresponds to _CM_KEY_INDEX.Signature.

pub fn count(&self) -> Result<u16, VmiError>

Returns the number of entries in the list.

Implementation Details

Corresponds to _CM_KEY_INDEX.Count.

pub fn list(&self) -> Result<Va, VmiError>

Returns the address of the first entry in the index.

Implementation Details

Corresponds to _CM_KEY_INDEX.List.

pub fn entry_size(&self) -> Result<u64, VmiError>

Returns the byte size of one entry.

4 bytes for il and ir. 8 bytes for fl and hl, which pair each HCELL_INDEX with a 4-byte name hint or hash.

Reads the signature. Prefer entry_size_for when the signature is already in scope.

pub fn entry_size_for(signature: u16) -> Result<u64, VmiError>

Returns the byte size of one entry for a given index signature.

Variant of entry_size that takes the signature directly, avoiding the read.

Trait Implementations

impl<Driver> VmiVa for WindowsKeyIndex<'_, Driver>

where Driver: VmiRead, <Driver as VmiDriver>::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.