Versions in this module Expand all Collapse all v0 v0.1.1 Apr 23, 2022 v0.1.0 Feb 22, 2021 Changes in this version + var DataTypeEnum = struct{ ... } + var FileFormat = struct{ ... } + var FileType = struct{ ... } + var NkFlags = struct{ ... } + var VkFlags = struct{ ... } + func DecodeRegSz(b []byte) (string, error) + func DecodeUTF16(b []byte) (string, error) + type File struct + func (f *File) Close() error + func (f *File) Info() (fs.FileInfo, error) + func (f *File) IsDir() bool + func (f *File) ModTime() time.Time + func (f *File) Mode() fs.FileMode + func (f *File) Name() string + func (f *File) Read(i []byte) (int, error) + func (f *File) ReadDir(n int) ([]fs.DirEntry, error) + func (f *File) Size() int64 + func (f *File) Stat() (fs.FileInfo, error) + func (f *File) Sys() interface{} + func (f *File) Type() fs.FileMode + type FileHeader struct + func (k *FileHeader) BootRecover() (value uint32) + func (k *FileHeader) BootType() (value uint32) + func (k *FileHeader) Checksum() (value uint32) + func (k *FileHeader) ClusteringFactor() (value uint32) + func (k *FileHeader) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *FileHeader) Format() (value uint32) + func (k *FileHeader) HeaderType() (value uint32) + func (k *FileHeader) HiveBinsDataSize() (value uint32) + func (k *FileHeader) LastModificationDateAndTime() (value *Filetime) + func (k *FileHeader) MajorVersion() (value uint32) + func (k *FileHeader) MinorVersion() (value uint32) + func (k *FileHeader) Parent() *Regf + func (k *FileHeader) PrimarySequenceNumber() (value uint32) + func (k *FileHeader) Reserved() (value []byte) + func (k *FileHeader) Root() *Regf + func (k *FileHeader) RootKeyOffset() (value uint32) + func (k *FileHeader) SecondarySequenceNumber() (value uint32) + func (k *FileHeader) Signature() (value []byte) + func (k *FileHeader) Unknown1() (value []byte) + func (k *FileHeader) Unknown2() (value []byte) + type Filetime struct + func (k *Filetime) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *Filetime) Parent() *FileHeader + func (k *Filetime) Root() *Regf + func (k *Filetime) Value() (value uint64) + type HiveBin struct + func (k *HiveBin) Cells() (value []HiveBinCell) + func (k *HiveBin) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *HiveBin) Header() (value *HiveBinHeader) + func (k *HiveBin) Parent() *Regf + func (k *HiveBin) Root() *Regf + type HiveBinCell struct + func (k *HiveBinCell) CellSize() (value int64) + func (k *HiveBinCell) CellSizeRaw() (value int32) + func (k *HiveBinCell) Data() (value KSYDecoder) + func (k *HiveBinCell) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *HiveBinCell) Identifier() (value []byte) + func (k *HiveBinCell) IsAllocated() (value bool) + func (k *HiveBinCell) Parent() *HiveBin + func (k *HiveBinCell) Root() *Regf + type HiveBinHeader struct + func (k *HiveBinHeader) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *HiveBinHeader) Offset() (value uint32) + func (k *HiveBinHeader) Parent() *HiveBin + func (k *HiveBinHeader) Root() *Regf + func (k *HiveBinHeader) Signature() (value []byte) + func (k *HiveBinHeader) Size() (value uint32) + func (k *HiveBinHeader) Timestamp() (value *Filetime) + func (k *HiveBinHeader) Unknown1() (value uint32) + func (k *HiveBinHeader) Unknown2() (value uint32) + func (k *HiveBinHeader) Unknown4() (value uint32) + type KSYDecoder interface + Decode func(io.ReadSeeker, ...interface{}) error + type LhLfItem struct + func (k *LhLfItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *LhLfItem) HashValue() (value uint32) + func (k *LhLfItem) NamedKeyOffset() (value uint32) + func (k *LhLfItem) Parent() *SubKeyListLhLf + func (k *LhLfItem) Root() *Regf + type LiItem struct + func (k *LiItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *LiItem) NamedKeyOffset() (value uint32) + func (k *LiItem) Parent() *SubKeyListLi + func (k *LiItem) Root() *Regf + type NamedKey struct + func (k *NamedKey) ClassNameOffset() (value uint32) + func (k *NamedKey) ClassNameSize() (value uint16) + func (k *NamedKey) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *NamedKey) Flags() (value uint16) + func (k *NamedKey) KeyNameSize() (value uint16) + func (k *NamedKey) LargestSubKeyClassNameSize() (value uint32) + func (k *NamedKey) LargestSubKeyNameSize() (value uint32) + func (k *NamedKey) LargestValueDataSize() (value uint32) + func (k *NamedKey) LargestValueNameSize() (value uint32) + func (k *NamedKey) LastKeyWrittenDateAndTime() (value *Filetime) + func (k *NamedKey) NumberOfSubKeys() (value uint32) + func (k *NamedKey) NumberOfValues() (value uint32) + func (k *NamedKey) NumberOfVolatileSubKeys() (value uint32) + func (k *NamedKey) Parent() *HiveBinCell + func (k *NamedKey) ParentKeyOffset() (value uint32) + func (k *NamedKey) Root() *Regf + func (k *NamedKey) SecurityKeyOffset() (value uint32) + func (k *NamedKey) SubKeysListOffset() (value uint32) + func (k *NamedKey) Unknown1() (value uint32) + func (k *NamedKey) Unknown2() (value uint32) + func (k *NamedKey) UnknownString() (value []byte) + func (k *NamedKey) UnknownStringSize() (value uint16) + func (k *NamedKey) ValuesListOffset() (value uint32) + type Regf struct + func (k *Regf) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *Regf) Header() (value *FileHeader) + func (k *Regf) HiveBins() (value []HiveBin) + func (k *Regf) Parent() *Regf + func (k *Regf) Root() *Regf + type Regffs struct + func New(f io.ReadSeeker) (*Regffs, error) + func (r *Regffs) Open(name string) (fs.File, error) + type RiItem struct + func (k *RiItem) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *RiItem) Parent() *SubKeyListRi + func (k *RiItem) Root() *Regf + func (k *RiItem) SubKeyListOffset() (value uint32) + type SubKeyListLhLf struct + func (k *SubKeyListLhLf) Count() (value uint16) + func (k *SubKeyListLhLf) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *SubKeyListLhLf) Items() (value []LhLfItem) + func (k *SubKeyListLhLf) Parent() *HiveBinCell + func (k *SubKeyListLhLf) Root() *Regf + type SubKeyListLi struct + func (k *SubKeyListLi) Count() (value uint16) + func (k *SubKeyListLi) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *SubKeyListLi) Items() (value []LiItem) + func (k *SubKeyListLi) Parent() *HiveBinCell + func (k *SubKeyListLi) Root() *Regf + type SubKeyListRi struct + func (k *SubKeyListRi) Count() (value uint16) + func (k *SubKeyListRi) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *SubKeyListRi) Items() (value []RiItem) + func (k *SubKeyListRi) Parent() *HiveBinCell + func (k *SubKeyListRi) Root() *Regf + type SubKeyListSk struct + func (k *SubKeyListSk) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *SubKeyListSk) NextSecurityKeyOffset() (value uint32) + func (k *SubKeyListSk) Parent() *HiveBinCell + func (k *SubKeyListSk) PreviousSecurityKeyOffset() (value uint32) + func (k *SubKeyListSk) ReferenceCount() (value uint32) + func (k *SubKeyListSk) Root() *Regf + func (k *SubKeyListSk) Unknown1() (value uint16) + type SubKeyListVk struct + func (k *SubKeyListVk) DataOffset() (value uint32) + func (k *SubKeyListVk) DataSize() (value uint32) + func (k *SubKeyListVk) DataType() (value uint32) + func (k *SubKeyListVk) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error) + func (k *SubKeyListVk) Flags() (value uint16) + func (k *SubKeyListVk) Padding() (value uint16) + func (k *SubKeyListVk) Parent() *HiveBinCell + func (k *SubKeyListVk) Root() *Regf + func (k *SubKeyListVk) ValueName() (value []byte) + func (k *SubKeyListVk) ValueNameSize() (value uint16)