libregf/dtfabric.yaml at main · libyal/libregf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
name: regf
type: format
description: Windows NT Registry File (REGF) format
urls: ['https://github.com/libyal/libregf/blob/main/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc']
metadata:
  authors: ['Joachim Metz <joachim.metz@gmail.com>']
  year: 2009
attributes:
  byte_order: little-endian
layout:
- data_type: file_header
  offset: 0
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint16
type: integer
attributes:
  format: unsigned
  size: 2
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: wchar16
type: character
attributes:
  size: 2
  units: bytes
---
name: filetime
aliases: [FILETIME]
type: structure
description: FILETIME structure
urls: ['https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime']
members:
- name: lower_part
  data_type: uint32
- name: upper_part
  data_type: uint32
---
name: file_header
type: structure
description: File header
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "regf"
- name: primary_sequence_number
  data_type: uint32
- name: secondary_sequence_number
  data_type: uint32
- name: modification_time
  data_type: filetime
- name: major_format_version
  data_type: uint32
- name: minor_format_version
  data_type: uint32
- name: file_type
  data_type: uint32
- name: unknown1
  data_type: uint32
- name: root_key_offset
  data_type: uint32
- name: hive_bins_size
  data_type: uint32
- name: unknown2
  data_type: uint32
- name: unknown3
  type: stream
  element_data_type: byte
  elements_data_size: 64
- name: unknown4
  type: stream
  element_data_type: byte
  elements_data_size: 396
- name: checksum
  data_type: uint32
---
name: hive_bin_header
type: structure
description: Hive bin header
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "hbin"
- name: hive_bin_offset
  data_type: uint32
- name: size
  data_type: uint32
- name: unknown1
  data_type: uint32
- name: unknown2
  data_type: uint32
- name: unknown_time
  data_type: filetime
- name: unknown_spare
  data_type: uint32
---
name: named_key
aliases: [CM_KEY_NODE]
type: structure
description: Named key
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 2
  value: "nk"
- name: flags
  data_type: uint16
- name: last_written_time
  description: Last written date and time
  data_type: filetime
- name: unknown1
  data_type: uint32
- name: parent_key_offset
  data_type: uint32
- name: number_of_sub_keys
  data_type: uint32
- name: number_of_volatile_sub_keys
  data_type: uint32
- name: sub_keys_list_offset
  data_type: uint32
- name: volatile_sub_keys_list_offset
  data_type: uint32
- name: number_of_values
  data_type: uint32
- name: values_list_offset
  data_type: uint32
- name: security_key_offset
  data_type: uint32
- name: class_name_offset
  data_type: uint32
- name: largest_sub_key_name_size
  data_type: uint32
- name: largest_sub_key_class_name_size
  data_type: uint32
- name: largest_value_name_size
  data_type: uint32
- name: largest_value_data_size
  data_type: uint32
- name: unknown2
  data_type: uint32
- name: name_size
  data_type: uint16
- name: class_name_size
  data_type: uint16
- name: name
  type: stream
  element_data_type: byte
  elements_data_size: named_key.name_size
- name: padding
  type: padding
  alignment_size: 8
---
name: value_key
aliases: [CM_KEY_VALUE]
type: structure
description: Value key
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 2
  value: "vk"
- name: name_size
  data_type: uint16
- name: data_size
  data_type: uint32
- name: data_offset
  data_type: uint32
- name: data_type
  data_type: uint32
- name: flags
  data_type: uint16
- name: unknown1
  data_type: uint16
- name: name
  type: stream
  element_data_type: byte
  elements_data_size: value_key.name_size
- name: padding
  type: padding
  alignment_size: 8
---
name: security_key
type: structure
description: Security key
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 2
  value: "sk"
- name: unknown1
  data_type: uint16
- name: previous_security_key_offset
  data_type: uint32
- name: next_security_key_offset
  data_type: uint32
- name: reference_count
  data_type: uint32
- name: security_descriptor_size
  data_type: uint32
- name: security_descriptor
  type: stream
  element_data_type: byte
  elements_data_size: security_key.security_descriptor_size
- name: padding
  type: padding
  alignment_size: 8