Function get_data_value

archive/ntreg/src/registry_value.rs:150–212

(value_information: PKEY_VALUE_FULL_INFORMATION)

}

fn get_data_value(value_information: PKEY_VALUE_FULL_INFORMATION) -> RegistryValueData {
    let data_length = unsafe {
        (*value_information).DataLength as usize
    };

    let data_ptr = unsafe {
        (value_information as *const u8).add((*value_information).DataOffset as usize)
    };

    let data = unsafe {
        std::slice::from_raw_parts(data_ptr, data_length)
    };

    match unsafe { (*value_information).Type } {
        1 => RegistryValueData::String(String::from_utf16_lossy(unsafe {
            // remove null terminator
            std::slice::from_raw_parts(data_ptr as *const u16, (data_length / size_of::<u16>()) - 1)
        })),
        2 => RegistryValueData::ExpandString(String::from_utf16_lossy(unsafe {
            // remove null terminator
            std::slice::from_raw_parts(data_ptr as *const u16, (data_length / size_of::<u16>()) - 1)
        })),
        3 => RegistryValueData::Binary(data.to_vec()),
        4 => RegistryValueData::DWord(unsafe {
            *(data_ptr as *const u32)
        }),
        6 => RegistryValueData::Link(String::from_utf16_lossy(unsafe {
            // remove null terminator
            std::slice::from_raw_parts(data_ptr as *const u16, (data_length / size_of::<u16>()) - 1)
        })),
        7 => {
            let mut multi_string: Vec<String> = Vec::new();
            let mut offset = 0;
            while offset < data_length {
                let mut string_length = 0;
                while offset + string_length < data_length && unsafe { *(data_ptr.add(offset + string_length) as *mut u16) } != 0 {
                    string_length += size_of::<u16>();
                }

                let string = String::from_utf16_lossy(unsafe {
                    std::slice::from_raw_parts(data_ptr.add(offset) as *const u16, string_length / size_of::<u16>())
                });

                if string.is_empty() {
                    // end of multi string null terminator
                    break;
                }

                multi_string.push(string);
                offset += string_length + size_of::<u16>();
            }

            RegistryValueData::MultiString(multi_string)
        },
        8 => RegistryValueData::ResourceList(data.to_vec()),
        9 => RegistryValueData::FullResourceDescriptor(data.to_vec()),
        10 => RegistryValueData::ResourceRequirementsList(data.to_vec()),
        11 => RegistryValueData::QWord(unsafe {