go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/providers/os/resources/windows/registrykey.go (about)

     1  // Copyright (c) Mondoo, Inc.
     2  // SPDX-License-Identifier: BUSL-1.1
     3  
     4  package windows
     5  
     6  import "go.mondoo.com/cnquery/providers-sdk/v1/util/convert"
     7  
     8  // derived from "golang.org/x/sys/windows/registry"
     9  // see https://github.com/golang/sys/blob/master/windows/registry/value.go#L17-L31
    10  const (
    11  	NONE                       = 0
    12  	SZ                         = 1
    13  	EXPAND_SZ                  = 2
    14  	BINARY                     = 3
    15  	DWORD                      = 4
    16  	DWORD_BIG_ENDIAN           = 5
    17  	LINK                       = 6
    18  	MULTI_SZ                   = 7
    19  	RESOURCE_LIST              = 8
    20  	FULL_RESOURCE_DESCRIPTOR   = 9
    21  	RESOURCE_REQUIREMENTS_LIST = 10
    22  	QWORD                      = 11
    23  )
    24  
    25  type RegistryKeyItem struct {
    26  	Key   string
    27  	Value RegistryKeyValue
    28  }
    29  
    30  func (k RegistryKeyItem) Kind() string {
    31  	switch k.Value.Kind {
    32  	case NONE:
    33  		return "bone"
    34  	case SZ:
    35  		return "string"
    36  	case EXPAND_SZ:
    37  		return "expandstring"
    38  	case BINARY:
    39  		return "binary"
    40  	case DWORD:
    41  		return "dword"
    42  	case DWORD_BIG_ENDIAN:
    43  		return "dword"
    44  	case LINK:
    45  		return "link"
    46  	case MULTI_SZ:
    47  		return "multistring"
    48  	case RESOURCE_LIST:
    49  		return "<unsupported>"
    50  	case FULL_RESOURCE_DESCRIPTOR:
    51  		return "<unsupported>"
    52  	case RESOURCE_REQUIREMENTS_LIST:
    53  		return "<unsupported>"
    54  	case QWORD:
    55  		return "qword"
    56  	}
    57  	return "<unsupported>"
    58  }
    59  
    60  func (k RegistryKeyItem) GetRawValue() interface{} {
    61  	switch k.Value.Kind {
    62  	case NONE:
    63  		return nil
    64  	case SZ:
    65  		return k.Value.String
    66  	case EXPAND_SZ:
    67  		return k.Value.String
    68  	case BINARY:
    69  		return k.Value.Binary
    70  	case DWORD:
    71  		return k.Value.Number
    72  	case DWORD_BIG_ENDIAN:
    73  		return nil
    74  	case LINK:
    75  		return nil
    76  	case MULTI_SZ:
    77  		return convert.SliceAnyToInterface(k.Value.MultiString)
    78  	case RESOURCE_LIST:
    79  		return nil
    80  	case FULL_RESOURCE_DESCRIPTOR:
    81  		return nil
    82  	case RESOURCE_REQUIREMENTS_LIST:
    83  		return nil
    84  	case QWORD:
    85  		return k.Value.Number
    86  	}
    87  	return nil
    88  }
    89  
    90  // String returns a string representation of the registry key value
    91  func (k RegistryKeyItem) String() string {
    92  	return k.Value.String // conversion to string is handled in UnmarshalJSON
    93  }
    94  
    95  type RegistryKeyValue struct {
    96  	Kind        int
    97  	Binary      []byte
    98  	Number      int64
    99  	String      string
   100  	MultiString []string
   101  }
   102  
   103  type RegistryKeyChild struct {
   104  	Name       string
   105  	Path       string
   106  	Properties []string
   107  }