regffs

package module
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 23, 2022 License: MIT Imports: 12 Imported by: 0

README

regffs

doc

Read Windows registry files (regf) as io/fs.FS.

Example

func main() {
	f, _ := os.Open("testdata/SYSTEM")

	// init file system
	fsys, _ := regffs.New(f)

	// print all paths
	b, _ := fs.ReadFile(fsys, "ControlSet001/Control/ComputerName/ComputerName/ComputerName")
	s, _ := regffs.DecodeRegSz(b)
	fmt.Println(s)
	// Output: WKS-WIN732BITA
}

License

testdata is from https://github.com/log2timeline/plaso and therefore licenced under Apache License 2.0. The remaining files are MIT licensed.

Documentation

Overview

Example 
package main

import (
	"fmt"
	"github.com/forensicanalysis/regffs"
	"io/fs"
	"os"
)

func main() {
	f, _ := os.Open("testdata/SYSTEM")

	// init file system
	fsys, _ := regffs.New(f)

	// print all paths
	b, _ := fs.ReadFile(fsys, "ControlSet001/Control/ComputerName/ComputerName/ComputerName")
	s, _ := regffs.DecodeRegSz(b)
	fmt.Println(s)
}

Output:

WKS-WIN732BITA

Index

Examples

Constants

This section is empty.

Variables

View Source 
var DataTypeEnum = struct {
	RegDwordBigEndian           uint32
	RegLink                     uint32
	RegResourceList             uint32
	RegFullResourceDescriptor   uint32
	RegResourceRequirementsList uint32
	RegQword                    uint32
	RegNone                     uint32
	RegExpandSz                 uint32
	RegBinary                   uint32
	RegDword                    uint32
	RegMultiSz                  uint32
	RegSz                       uint32
}{
	RegSz:                       1,
	RegExpandSz:                 2,
	RegBinary:                   3,
	RegDword:                    4,
	RegMultiSz:                  7,
	RegNone:                     0,
	RegDwordBigEndian:           5,
	RegLink:                     6,
	RegResourceList:             8,
	RegFullResourceDescriptor:   9,
	RegResourceRequirementsList: 10,
	RegQword:                    11,
}
View Source 
var FileFormat = struct {
	DirectMemoryLoad uint32
}{
	DirectMemoryLoad: 1,
}
View Source 
var FileType = struct {
	TransactionLog uint32
	Normal         uint32
}{
	Normal:         0,
	TransactionLog: 1,
}
View Source 
var NkFlags = struct {
	Unknown1        uint16
	KeyHiveExit     uint16
	KeyHiveEntry    uint16
	KeyNoDelete     uint16
	KeyPrefefHandle uint16
	KeyVirtMirrored uint16
	KeyVirtTarget   uint16
	KeyVirtualStore uint16
	KeyIsVolatile   uint16
	KeySymLink      uint16
	KeyCompName     uint16
	Unknown2        uint16
}{
	KeyCompName:     32,
	Unknown2:        16384,
	KeyIsVolatile:   1,
	KeySymLink:      16,
	KeyNoDelete:     8,
	KeyPrefefHandle: 64,
	KeyVirtMirrored: 128,
	KeyVirtTarget:   256,
	KeyVirtualStore: 512,
	Unknown1:        4096,
	KeyHiveExit:     2,
	KeyHiveEntry:    4,
}
View Source 
var VkFlags = struct {
	ValueCompName uint16
}{
	ValueCompName: 1,
}

Functions

func DecodeRegSz 

func DecodeRegSz(b []byte) (string, error)

func DecodeUTF16 

func DecodeUTF16(b []byte) (string, error)

Types

type File 

type File struct {
	// contains filtered or unexported fields
}

func (*File) Close 

func (f *File) Close() error

func (*File) Info 

func (f *File) Info() (fs.FileInfo, error)

func (*File) IsDir 

func (f *File) IsDir() bool

func (*File) ModTime 

func (f *File) ModTime() time.Time

func (*File) Mode 

func (f *File) Mode() fs.FileMode

func (*File) Name 

func (f *File) Name() string

func (*File) Read 

func (f *File) Read(i []byte) (int, error)

func (*File) ReadDir 

func (f *File) ReadDir(n int) ([]fs.DirEntry, error)

func (*File) Size 

func (f *File) Size() int64

func (*File) Stat 

func (f *File) Stat() (fs.FileInfo, error)

func (*File) Sys 

func (f *File) Sys() interface{}

func (*File) Type 

func (f *File) Type() fs.FileMode

type FileHeader 

type FileHeader struct {
	// contains filtered or unexported fields
}

func (*FileHeader) BootRecover 

func (k *FileHeader) BootRecover() (value uint32)

func (*FileHeader) BootType 

func (k *FileHeader) BootType() (value uint32)

func (*FileHeader) Checksum 

func (k *FileHeader) Checksum() (value uint32)

func (*FileHeader) ClusteringFactor 

func (k *FileHeader) ClusteringFactor() (value uint32)

func (*FileHeader) Decode 

func (k *FileHeader) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*FileHeader) Format 

func (k *FileHeader) Format() (value uint32)

func (*FileHeader) HeaderType 

func (k *FileHeader) HeaderType() (value uint32)

func (*FileHeader) HiveBinsDataSize 

func (k *FileHeader) HiveBinsDataSize() (value uint32)

func (*FileHeader) LastModificationDateAndTime 

func (k *FileHeader) LastModificationDateAndTime() (value *Filetime)

func (*FileHeader) MajorVersion 

func (k *FileHeader) MajorVersion() (value uint32)

func (*FileHeader) MinorVersion 

func (k *FileHeader) MinorVersion() (value uint32)

func (*FileHeader) Parent 

func (k *FileHeader) Parent() *Regf

func (*FileHeader) PrimarySequenceNumber 

func (k *FileHeader) PrimarySequenceNumber() (value uint32)

func (*FileHeader) Reserved 

func (k *FileHeader) Reserved() (value []byte)

func (*FileHeader) Root 

func (k *FileHeader) Root() *Regf

func (*FileHeader) RootKeyOffset 

func (k *FileHeader) RootKeyOffset() (value uint32)

func (*FileHeader) SecondarySequenceNumber 

func (k *FileHeader) SecondarySequenceNumber() (value uint32)

func (*FileHeader) Signature 

func (k *FileHeader) Signature() (value []byte)

func (*FileHeader) Unknown1 

func (k *FileHeader) Unknown1() (value []byte)

func (*FileHeader) Unknown2 

func (k *FileHeader) Unknown2() (value []byte)

type Filetime 

type Filetime struct {
	// contains filtered or unexported fields
}

func (*Filetime) Decode 

func (k *Filetime) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*Filetime) Parent 

func (k *Filetime) Parent() *FileHeader

func (*Filetime) Root 

func (k *Filetime) Root() *Regf

func (*Filetime) Value 

func (k *Filetime) Value() (value uint64)

type HiveBin 

type HiveBin struct {
	// contains filtered or unexported fields
}

func (*HiveBin) Cells 

func (k *HiveBin) Cells() (value []HiveBinCell)

func (*HiveBin) Decode 

func (k *HiveBin) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*HiveBin) Header 

func (k *HiveBin) Header() (value *HiveBinHeader)

func (*HiveBin) Parent 

func (k *HiveBin) Parent() *Regf

func (*HiveBin) Root 

func (k *HiveBin) Root() *Regf

type HiveBinCell 

type HiveBinCell struct {
	// contains filtered or unexported fields
}

func (*HiveBinCell) CellSize 

func (k *HiveBinCell) CellSize() (value int64)

func (*HiveBinCell) CellSizeRaw 

func (k *HiveBinCell) CellSizeRaw() (value int32)

func (*HiveBinCell) Data 

func (k *HiveBinCell) Data() (value KSYDecoder)

func (*HiveBinCell) Decode 

func (k *HiveBinCell) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*HiveBinCell) Identifier 

func (k *HiveBinCell) Identifier() (value []byte)

func (*HiveBinCell) IsAllocated 

func (k *HiveBinCell) IsAllocated() (value bool)

func (*HiveBinCell) Parent 

func (k *HiveBinCell) Parent() *HiveBin

func (*HiveBinCell) Root 

func (k *HiveBinCell) Root() *Regf

type HiveBinHeader 

type HiveBinHeader struct {
	// contains filtered or unexported fields
}

func (*HiveBinHeader) Decode 

func (k *HiveBinHeader) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*HiveBinHeader) Offset 

func (k *HiveBinHeader) Offset() (value uint32)

func (*HiveBinHeader) Parent 

func (k *HiveBinHeader) Parent() *HiveBin

func (*HiveBinHeader) Root 

func (k *HiveBinHeader) Root() *Regf

func (*HiveBinHeader) Signature 

func (k *HiveBinHeader) Signature() (value []byte)

func (*HiveBinHeader) Size 

func (k *HiveBinHeader) Size() (value uint32)

func (*HiveBinHeader) Timestamp 

func (k *HiveBinHeader) Timestamp() (value *Filetime)

func (*HiveBinHeader) Unknown1 

func (k *HiveBinHeader) Unknown1() (value uint32)

func (*HiveBinHeader) Unknown2 

func (k *HiveBinHeader) Unknown2() (value uint32)

func (*HiveBinHeader) Unknown4 

func (k *HiveBinHeader) Unknown4() (value uint32)

type KSYDecoder 

type KSYDecoder interface {
	Decode(io.ReadSeeker, ...interface{}) error
}

type LhLfItem 

type LhLfItem struct {
	// contains filtered or unexported fields
}

func (*LhLfItem) Decode 

func (k *LhLfItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*LhLfItem) HashValue 

func (k *LhLfItem) HashValue() (value uint32)

func (*LhLfItem) NamedKeyOffset 

func (k *LhLfItem) NamedKeyOffset() (value uint32)

func (*LhLfItem) Parent 

func (k *LhLfItem) Parent() *SubKeyListLhLf

func (*LhLfItem) Root 

func (k *LhLfItem) Root() *Regf

type LiItem 

type LiItem struct {
	// contains filtered or unexported fields
}

func (*LiItem) Decode 

func (k *LiItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*LiItem) NamedKeyOffset 

func (k *LiItem) NamedKeyOffset() (value uint32)

func (*LiItem) Parent 

func (k *LiItem) Parent() *SubKeyListLi

func (*LiItem) Root 

func (k *LiItem) Root() *Regf

type NamedKey 

type NamedKey struct {
	// contains filtered or unexported fields
}

func (*NamedKey) ClassNameOffset 

func (k *NamedKey) ClassNameOffset() (value uint32)

func (*NamedKey) ClassNameSize 

func (k *NamedKey) ClassNameSize() (value uint16)

func (*NamedKey) Decode 

func (k *NamedKey) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*NamedKey) Flags 

func (k *NamedKey) Flags() (value uint16)

func (*NamedKey) KeyNameSize 

func (k *NamedKey) KeyNameSize() (value uint16)

func (*NamedKey) LargestSubKeyClassNameSize 

func (k *NamedKey) LargestSubKeyClassNameSize() (value uint32)

func (*NamedKey) LargestSubKeyNameSize 

func (k *NamedKey) LargestSubKeyNameSize() (value uint32)

func (*NamedKey) LargestValueDataSize 

func (k *NamedKey) LargestValueDataSize() (value uint32)

func (*NamedKey) LargestValueNameSize 

func (k *NamedKey) LargestValueNameSize() (value uint32)

func (*NamedKey) LastKeyWrittenDateAndTime 

func (k *NamedKey) LastKeyWrittenDateAndTime() (value *Filetime)

func (*NamedKey) NumberOfSubKeys 

func (k *NamedKey) NumberOfSubKeys() (value uint32)

func (*NamedKey) NumberOfValues 

func (k *NamedKey) NumberOfValues() (value uint32)

func (*NamedKey) NumberOfVolatileSubKeys 

func (k *NamedKey) NumberOfVolatileSubKeys() (value uint32)

func (*NamedKey) Parent 

func (k *NamedKey) Parent() *HiveBinCell

func (*NamedKey) ParentKeyOffset 

func (k *NamedKey) ParentKeyOffset() (value uint32)

func (*NamedKey) Root 

func (k *NamedKey) Root() *Regf

func (*NamedKey) SecurityKeyOffset 

func (k *NamedKey) SecurityKeyOffset() (value uint32)

func (*NamedKey) SubKeysListOffset 

func (k *NamedKey) SubKeysListOffset() (value uint32)

func (*NamedKey) Unknown1 

func (k *NamedKey) Unknown1() (value uint32)

func (*NamedKey) Unknown2 

func (k *NamedKey) Unknown2() (value uint32)

func (*NamedKey) UnknownString 

func (k *NamedKey) UnknownString() (value []byte)

func (*NamedKey) UnknownStringSize 

func (k *NamedKey) UnknownStringSize() (value uint16)

func (*NamedKey) ValuesListOffset 

func (k *NamedKey) ValuesListOffset() (value uint32)

type Regf 

type Regf struct {
	// contains filtered or unexported fields
}
This spec allows to parse files used by Microsoft Windows family of

operating systems to store parts of its "registry". "Registry" is a hierarchical database that is used to store system settings (global configuration, per-user, per-application configuration, etc).

Typically, registry files are stored in:

* System-wide: several files in `%SystemRoot%\System32\Config\` * User-wide:

  • `%USERPROFILE%\Ntuser.dat`
  • `%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat` (localized, Windows 2000, Server 2003 and Windows XP)
  • `%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat` (non-localized, Windows Vista and later)

Note that one typically can't access files directly on a mounted filesystem with a running Windows OS.

func (*Regf) Decode 

func (k *Regf) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*Regf) Header 

func (k *Regf) Header() (value *FileHeader)

func (*Regf) HiveBins 

func (k *Regf) HiveBins() (value []HiveBin)

func (*Regf) Parent 

func (k *Regf) Parent() *Regf

func (*Regf) Root 

func (k *Regf) Root() *Regf

type Regffs 

type Regffs struct {
	// contains filtered or unexported fields
}

func New 

func New(f io.ReadSeeker) (*Regffs, error)

func (*Regffs) Open 

func (r *Regffs) Open(name string) (fs.File, error)

type RiItem 

type RiItem struct {
	// contains filtered or unexported fields
}

func (*RiItem) Decode 

func (k *RiItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*RiItem) Parent 

func (k *RiItem) Parent() *SubKeyListRi

func (*RiItem) Root 

func (k *RiItem) Root() *Regf

func (*RiItem) SubKeyListOffset 

func (k *RiItem) SubKeyListOffset() (value uint32)

type SubKeyListLhLf 

type SubKeyListLhLf struct {
	// contains filtered or unexported fields
}

func (*SubKeyListLhLf) Count 

func (k *SubKeyListLhLf) Count() (value uint16)

func (*SubKeyListLhLf) Decode 

func (k *SubKeyListLhLf) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*SubKeyListLhLf) Items 

func (k *SubKeyListLhLf) Items() (value []LhLfItem)

func (*SubKeyListLhLf) Parent 

func (k *SubKeyListLhLf) Parent() *HiveBinCell

func (*SubKeyListLhLf) Root 

func (k *SubKeyListLhLf) Root() *Regf

type SubKeyListLi 

type SubKeyListLi struct {
	// contains filtered or unexported fields
}

func (*SubKeyListLi) Count 

func (k *SubKeyListLi) Count() (value uint16)

func (*SubKeyListLi) Decode 

func (k *SubKeyListLi) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*SubKeyListLi) Items 

func (k *SubKeyListLi) Items() (value []LiItem)

func (*SubKeyListLi) Parent 

func (k *SubKeyListLi) Parent() *HiveBinCell

func (*SubKeyListLi) Root 

func (k *SubKeyListLi) Root() *Regf

type SubKeyListRi 

type SubKeyListRi struct {
	// contains filtered or unexported fields
}

func (*SubKeyListRi) Count 

func (k *SubKeyListRi) Count() (value uint16)

func (*SubKeyListRi) Decode 

func (k *SubKeyListRi) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*SubKeyListRi) Items 

func (k *SubKeyListRi) Items() (value []RiItem)

func (*SubKeyListRi) Parent 

func (k *SubKeyListRi) Parent() *HiveBinCell

func (*SubKeyListRi) Root 

func (k *SubKeyListRi) Root() *Regf

type SubKeyListSk 

type SubKeyListSk struct {
	// contains filtered or unexported fields
}

func (*SubKeyListSk) Decode 

func (k *SubKeyListSk) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*SubKeyListSk) NextSecurityKeyOffset 

func (k *SubKeyListSk) NextSecurityKeyOffset() (value uint32)

func (*SubKeyListSk) Parent 

func (k *SubKeyListSk) Parent() *HiveBinCell

func (*SubKeyListSk) PreviousSecurityKeyOffset 

func (k *SubKeyListSk) PreviousSecurityKeyOffset() (value uint32)

func (*SubKeyListSk) ReferenceCount 

func (k *SubKeyListSk) ReferenceCount() (value uint32)

func (*SubKeyListSk) Root 

func (k *SubKeyListSk) Root() *Regf

func (*SubKeyListSk) Unknown1 

func (k *SubKeyListSk) Unknown1() (value uint16)

type SubKeyListVk 

type SubKeyListVk struct {
	// contains filtered or unexported fields
}

func (*SubKeyListVk) DataOffset 

func (k *SubKeyListVk) DataOffset() (value uint32)

func (*SubKeyListVk) DataSize 

func (k *SubKeyListVk) DataSize() (value uint32)

func (*SubKeyListVk) DataType 

func (k *SubKeyListVk) DataType() (value uint32)

func (*SubKeyListVk) Decode 

func (k *SubKeyListVk) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*SubKeyListVk) Flags 

func (k *SubKeyListVk) Flags() (value uint16)

func (*SubKeyListVk) Padding 

func (k *SubKeyListVk) Padding() (value uint16)

func (*SubKeyListVk) Parent 

func (k *SubKeyListVk) Parent() *HiveBinCell

func (*SubKeyListVk) Root 

func (k *SubKeyListVk) Root() *Regf

func (*SubKeyListVk) ValueName 

func (k *SubKeyListVk) ValueName() (value []byte)

func (*SubKeyListVk) ValueNameSize 

func (k *SubKeyListVk) ValueNameSize() (value uint16)

Source Files

View all Source files

Directories

Path Synopsis
cmd
regffs

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.