Windows registry database: C++11/STL parsing library

This spec allows to parse files used by Microsoft Windows family of operating systems to store parts of its "registry". "Registry" is a hierarchical database that is used to store system settings (global configuration, per-user, per-application configuration, etc).

Typically, registry files are stored in:

  • System-wide: several files in %SystemRoot%\System32\Config\
  • User-wide:
    • %USERPROFILE%\Ntuser.dat
    • %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat (localized, Windows 2000, Server 2003 and Windows XP)
    • %USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat (non-localized, Windows Vista and later)

Note that one typically can't access files directly on a mounted filesystem with a running Windows OS.

Application

Windows NT and later

KS implementation details

License: CC0-1.0

References

This page hosts a formal specification of Windows registry database using Kaitai Struct. This specification can be automatically translated into a variety of programming languages to get a parsing library.

Usage

Runtime library

All parsing code for C++11/STL generated by Kaitai Struct depends on the C++/STL runtime library. You have to install it before you can parse data.

For C++, the easiest way is to clone the runtime library sources and build them along with your project.

Code

Using Kaitai Struct in C++/STL usually consists of 3 steps.

  1. We need to create an STL input stream (std::istream). One can open local file for that, or use existing std::string or char* buffer.
    #include <fstream>
    
    std::ifstream is("path/to/local/file.bin", std::ifstream::binary);
    
    #include <sstream>
    
    std::istringstream is(str);
    
    #include <sstream>
    
    const char buf[] = { ... };
    std::string str(buf, sizeof buf);
    std::istringstream is(str);
    
  2. We need to wrap our input stream into Kaitai stream:
    #include "kaitai/kaitaistream.h"
    
    kaitai::kstream ks(&is);
    
  3. And finally, we can invoke the parsing:
    regf_t data(&ks);
    

After that, one can get various attributes from the structure by invoking getter methods like:

data.header() // => get header

C++11/STL source code to parse Windows registry database

regf.h

#pragma once

// This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild

#include "kaitai/kaitaistruct.h"
#include <stdint.h>
#include <memory>
#include <vector>

#if KAITAI_STRUCT_VERSION < 9000L
#error "Incompatible Kaitai Struct C++/STL API: version 0.9 or later is required"
#endif

/**
 * This spec allows to parse files used by Microsoft Windows family of
 * operating systems to store parts of its "registry". "Registry" is a
 * hierarchical database that is used to store system settings (global
 * configuration, per-user, per-application configuration, etc).
 * 
 * Typically, registry files are stored in:
 * 
 * * System-wide: several files in `%SystemRoot%\System32\Config\`
 * * User-wide:
 *   * `%USERPROFILE%\Ntuser.dat`
 *   * `%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat` (localized, Windows 2000, Server 2003 and Windows XP)
 *   * `%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat` (non-localized, Windows Vista and later)
 * 
 * Note that one typically can't access files directly on a mounted
 * filesystem with a running Windows OS.
 * \sa https://github.com/libyal/libregf/blob/main/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc Source
 */

class regf_t : public kaitai::kstruct {

public:
    class filetime_t;
    class hive_bin_t;
    class hive_bin_header_t;
    class hive_bin_cell_t;
    class file_header_t;

    regf_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent = nullptr, regf_t* p__root = nullptr);

private:
    void _read();
    void _clean_up();

public:
    ~regf_t();

    class filetime_t : public kaitai::kstruct {

    public:

        filetime_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent = nullptr, regf_t* p__root = nullptr);

    private:
        void _read();
        void _clean_up();

    public:
        ~filetime_t();

    private:
        uint64_t m_value;
        regf_t* m__root;
        kaitai::kstruct* m__parent;

    public:
        uint64_t value() const { return m_value; }
        regf_t* _root() const { return m__root; }
        kaitai::kstruct* _parent() const { return m__parent; }
    };

    class hive_bin_t : public kaitai::kstruct {

    public:

        hive_bin_t(kaitai::kstream* p__io, regf_t* p__parent = nullptr, regf_t* p__root = nullptr);

    private:
        void _read();
        void _clean_up();

    public:
        ~hive_bin_t();

    private:
        std::unique_ptr<hive_bin_header_t> m_header;
        std::unique_ptr<std::vector<std::unique_ptr<hive_bin_cell_t>>> m_cells;
        regf_t* m__root;
        regf_t* m__parent;

    public:
        hive_bin_header_t* header() const { return m_header.get(); }
        std::vector<std::unique_ptr<hive_bin_cell_t>>* cells() const { return m_cells.get(); }
        regf_t* _root() const { return m__root; }
        regf_t* _parent() const { return m__parent; }
    };

    class hive_bin_header_t : public kaitai::kstruct {

    public:

        hive_bin_header_t(kaitai::kstream* p__io, regf_t::hive_bin_t* p__parent = nullptr, regf_t* p__root = nullptr);

    private:
        void _read();
        void _clean_up();

    public:
        ~hive_bin_header_t();

    private:
        std::string m_signature;
        uint32_t m_offset;
        uint32_t m_size;
        uint32_t m_unknown1;
        uint32_t m_unknown2;
        std::unique_ptr<filetime_t> m_timestamp;
        uint32_t m_unknown4;
        regf_t* m__root;
        regf_t::hive_bin_t* m__parent;

    public:
        std::string signature() const { return m_signature; }

        /**
         * The offset of the hive bin, Value in bytes and relative from
         * the start of the hive bin data
         */
        uint32_t offset() const { return m_offset; }

        /**
         * Size of the hive bin
         */
        uint32_t size() const { return m_size; }

        /**
         * 0 most of the time, can contain remnant data
         */
        uint32_t unknown1() const { return m_unknown1; }

        /**
         * 0 most of the time, can contain remnant data
         */
        uint32_t unknown2() const { return m_unknown2; }

        /**
         * Only the root (first) hive bin seems to contain a valid FILETIME
         */
        filetime_t* timestamp() const { return m_timestamp.get(); }

        /**
         * Contains number of bytes
         */
        uint32_t unknown4() const { return m_unknown4; }
        regf_t* _root() const { return m__root; }
        regf_t::hive_bin_t* _parent() const { return m__parent; }
    };

    class hive_bin_cell_t : public kaitai::kstruct {

    public:
        class sub_key_list_vk_t;
        class sub_key_list_lh_lf_t;
        class sub_key_list_sk_t;
        class sub_key_list_li_t;
        class named_key_t;
        class sub_key_list_ri_t;

        hive_bin_cell_t(kaitai::kstream* p__io, regf_t::hive_bin_t* p__parent = nullptr, regf_t* p__root = nullptr);

    private:
        void _read();
        void _clean_up();

    public:
        ~hive_bin_cell_t();

        class sub_key_list_vk_t : public kaitai::kstruct {

        public:

            enum data_type_enum_t {
                DATA_TYPE_ENUM_REG_NONE = 0,
                DATA_TYPE_ENUM_REG_SZ = 1,
                DATA_TYPE_ENUM_REG_EXPAND_SZ = 2,
                DATA_TYPE_ENUM_REG_BINARY = 3,
                DATA_TYPE_ENUM_REG_DWORD = 4,
                DATA_TYPE_ENUM_REG_DWORD_BIG_ENDIAN = 5,
                DATA_TYPE_ENUM_REG_LINK = 6,
                DATA_TYPE_ENUM_REG_MULTI_SZ = 7,
                DATA_TYPE_ENUM_REG_RESOURCE_LIST = 8,
                DATA_TYPE_ENUM_REG_FULL_RESOURCE_DESCRIPTOR = 9,
                DATA_TYPE_ENUM_REG_RESOURCE_REQUIREMENTS_LIST = 10,
                DATA_TYPE_ENUM_REG_QWORD = 11
            };

            enum vk_flags_t {
                VK_FLAGS_VALUE_COMP_NAME = 1
            };

            sub_key_list_vk_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~sub_key_list_vk_t();

        private:
            uint16_t m_value_name_size;
            uint32_t m_data_size;
            uint32_t m_data_offset;
            data_type_enum_t m_data_type;
            vk_flags_t m_flags;
            uint16_t m_padding;
            std::string m_value_name;
            bool n_value_name;

        public:
            bool _is_null_value_name() { value_name(); return n_value_name; };

        private:
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            uint16_t value_name_size() const { return m_value_name_size; }
            uint32_t data_size() const { return m_data_size; }
            uint32_t data_offset() const { return m_data_offset; }
            data_type_enum_t data_type() const { return m_data_type; }
            vk_flags_t flags() const { return m_flags; }
            uint16_t padding() const { return m_padding; }
            std::string value_name() const { return m_value_name; }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

        class sub_key_list_lh_lf_t : public kaitai::kstruct {

        public:
            class item_t;

            sub_key_list_lh_lf_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~sub_key_list_lh_lf_t();

            class item_t : public kaitai::kstruct {

            public:

                item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t* p__parent = nullptr, regf_t* p__root = nullptr);

            private:
                void _read();
                void _clean_up();

            public:
                ~item_t();

            private:
                uint32_t m_named_key_offset;
                uint32_t m_hash_value;
                regf_t* m__root;
                regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t* m__parent;

            public:
                uint32_t named_key_offset() const { return m_named_key_offset; }
                uint32_t hash_value() const { return m_hash_value; }
                regf_t* _root() const { return m__root; }
                regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t* _parent() const { return m__parent; }
            };

        private:
            uint16_t m_count;
            std::unique_ptr<std::vector<std::unique_ptr<item_t>>> m_items;
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            uint16_t count() const { return m_count; }
            std::vector<std::unique_ptr<item_t>>* items() const { return m_items.get(); }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

        class sub_key_list_sk_t : public kaitai::kstruct {

        public:

            sub_key_list_sk_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~sub_key_list_sk_t();

        private:
            uint16_t m_unknown1;
            uint32_t m_previous_security_key_offset;
            uint32_t m_next_security_key_offset;
            uint32_t m_reference_count;
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            uint16_t unknown1() const { return m_unknown1; }
            uint32_t previous_security_key_offset() const { return m_previous_security_key_offset; }
            uint32_t next_security_key_offset() const { return m_next_security_key_offset; }
            uint32_t reference_count() const { return m_reference_count; }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

        class sub_key_list_li_t : public kaitai::kstruct {

        public:
            class item_t;

            sub_key_list_li_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~sub_key_list_li_t();

            class item_t : public kaitai::kstruct {

            public:

                item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_li_t* p__parent = nullptr, regf_t* p__root = nullptr);

            private:
                void _read();
                void _clean_up();

            public:
                ~item_t();

            private:
                uint32_t m_named_key_offset;
                regf_t* m__root;
                regf_t::hive_bin_cell_t::sub_key_list_li_t* m__parent;

            public:
                uint32_t named_key_offset() const { return m_named_key_offset; }
                regf_t* _root() const { return m__root; }
                regf_t::hive_bin_cell_t::sub_key_list_li_t* _parent() const { return m__parent; }
            };

        private:
            uint16_t m_count;
            std::unique_ptr<std::vector<std::unique_ptr<item_t>>> m_items;
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            uint16_t count() const { return m_count; }
            std::vector<std::unique_ptr<item_t>>* items() const { return m_items.get(); }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

        class named_key_t : public kaitai::kstruct {

        public:

            enum nk_flags_t {
                NK_FLAGS_KEY_IS_VOLATILE = 1,
                NK_FLAGS_KEY_HIVE_EXIT = 2,
                NK_FLAGS_KEY_HIVE_ENTRY = 4,
                NK_FLAGS_KEY_NO_DELETE = 8,
                NK_FLAGS_KEY_SYM_LINK = 16,
                NK_FLAGS_KEY_COMP_NAME = 32,
                NK_FLAGS_KEY_PREFEF_HANDLE = 64,
                NK_FLAGS_KEY_VIRT_MIRRORED = 128,
                NK_FLAGS_KEY_VIRT_TARGET = 256,
                NK_FLAGS_KEY_VIRTUAL_STORE = 512,
                NK_FLAGS_UNKNOWN1 = 4096,
                NK_FLAGS_UNKNOWN2 = 16384
            };

            named_key_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~named_key_t();

        private:
            nk_flags_t m_flags;
            std::unique_ptr<filetime_t> m_last_key_written_date_and_time;
            uint32_t m_unknown1;
            uint32_t m_parent_key_offset;
            uint32_t m_number_of_sub_keys;
            uint32_t m_number_of_volatile_sub_keys;
            uint32_t m_sub_keys_list_offset;
            uint32_t m_number_of_values;
            uint32_t m_values_list_offset;
            uint32_t m_security_key_offset;
            uint32_t m_class_name_offset;
            uint32_t m_largest_sub_key_name_size;
            uint32_t m_largest_sub_key_class_name_size;
            uint32_t m_largest_value_name_size;
            uint32_t m_largest_value_data_size;
            uint32_t m_unknown2;
            uint16_t m_key_name_size;
            uint16_t m_class_name_size;
            uint32_t m_unknown_string_size;
            std::string m_unknown_string;
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            nk_flags_t flags() const { return m_flags; }
            filetime_t* last_key_written_date_and_time() const { return m_last_key_written_date_and_time.get(); }
            uint32_t unknown1() const { return m_unknown1; }
            uint32_t parent_key_offset() const { return m_parent_key_offset; }
            uint32_t number_of_sub_keys() const { return m_number_of_sub_keys; }
            uint32_t number_of_volatile_sub_keys() const { return m_number_of_volatile_sub_keys; }
            uint32_t sub_keys_list_offset() const { return m_sub_keys_list_offset; }
            uint32_t number_of_values() const { return m_number_of_values; }
            uint32_t values_list_offset() const { return m_values_list_offset; }
            uint32_t security_key_offset() const { return m_security_key_offset; }
            uint32_t class_name_offset() const { return m_class_name_offset; }
            uint32_t largest_sub_key_name_size() const { return m_largest_sub_key_name_size; }
            uint32_t largest_sub_key_class_name_size() const { return m_largest_sub_key_class_name_size; }
            uint32_t largest_value_name_size() const { return m_largest_value_name_size; }
            uint32_t largest_value_data_size() const { return m_largest_value_data_size; }
            uint32_t unknown2() const { return m_unknown2; }
            uint16_t key_name_size() const { return m_key_name_size; }
            uint16_t class_name_size() const { return m_class_name_size; }
            uint32_t unknown_string_size() const { return m_unknown_string_size; }
            std::string unknown_string() const { return m_unknown_string; }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

        class sub_key_list_ri_t : public kaitai::kstruct {

        public:
            class item_t;

            sub_key_list_ri_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent = nullptr, regf_t* p__root = nullptr);

        private:
            void _read();
            void _clean_up();

        public:
            ~sub_key_list_ri_t();

            class item_t : public kaitai::kstruct {

            public:

                item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_ri_t* p__parent = nullptr, regf_t* p__root = nullptr);

            private:
                void _read();
                void _clean_up();

            public:
                ~item_t();

            private:
                uint32_t m_sub_key_list_offset;
                regf_t* m__root;
                regf_t::hive_bin_cell_t::sub_key_list_ri_t* m__parent;

            public:
                uint32_t sub_key_list_offset() const { return m_sub_key_list_offset; }
                regf_t* _root() const { return m__root; }
                regf_t::hive_bin_cell_t::sub_key_list_ri_t* _parent() const { return m__parent; }
            };

        private:
            uint16_t m_count;
            std::unique_ptr<std::vector<std::unique_ptr<item_t>>> m_items;
            regf_t* m__root;
            regf_t::hive_bin_cell_t* m__parent;

        public:
            uint16_t count() const { return m_count; }
            std::vector<std::unique_ptr<item_t>>* items() const { return m_items.get(); }
            regf_t* _root() const { return m__root; }
            regf_t::hive_bin_cell_t* _parent() const { return m__parent; }
        };

    private:
        bool f_cell_size;
        int32_t m_cell_size;

    public:
        int32_t cell_size();

    private:
        bool f_is_allocated;
        bool m_is_allocated;

    public:
        bool is_allocated();

    private:
        int32_t m_cell_size_raw;
        std::string m_identifier;
        std::unique_ptr<kaitai::kstruct> m_data;
        bool n_data;

    public:
        bool _is_null_data() { data(); return n_data; };

    private:
        regf_t* m__root;
        regf_t::hive_bin_t* m__parent;
        std::string m__raw_data;
        std::unique_ptr<kaitai::kstream> m__io__raw_data;

    public:
        int32_t cell_size_raw() const { return m_cell_size_raw; }
        std::string identifier() const { return m_identifier; }
        kaitai::kstruct* data() const { return m_data.get(); }
        regf_t* _root() const { return m__root; }
        regf_t::hive_bin_t* _parent() const { return m__parent; }
        std::string _raw_data() const { return m__raw_data; }
        kaitai::kstream* _io__raw_data() const { return m__io__raw_data.get(); }
    };

    class file_header_t : public kaitai::kstruct {

    public:

        enum file_type_t {
            FILE_TYPE_NORMAL = 0,
            FILE_TYPE_TRANSACTION_LOG = 1
        };

        enum file_format_t {
            FILE_FORMAT_DIRECT_MEMORY_LOAD = 1
        };

        file_header_t(kaitai::kstream* p__io, regf_t* p__parent = nullptr, regf_t* p__root = nullptr);

    private:
        void _read();
        void _clean_up();

    public:
        ~file_header_t();

    private:
        std::string m_signature;
        uint32_t m_primary_sequence_number;
        uint32_t m_secondary_sequence_number;
        std::unique_ptr<filetime_t> m_last_modification_date_and_time;
        uint32_t m_major_version;
        uint32_t m_minor_version;
        file_type_t m_type;
        file_format_t m_format;
        uint32_t m_root_key_offset;
        uint32_t m_hive_bins_data_size;
        uint32_t m_clustering_factor;
        std::string m_unknown1;
        std::string m_unknown2;
        uint32_t m_checksum;
        std::string m_reserved;
        uint32_t m_boot_type;
        uint32_t m_boot_recover;
        regf_t* m__root;
        regf_t* m__parent;

    public:
        std::string signature() const { return m_signature; }
        uint32_t primary_sequence_number() const { return m_primary_sequence_number; }
        uint32_t secondary_sequence_number() const { return m_secondary_sequence_number; }
        filetime_t* last_modification_date_and_time() const { return m_last_modification_date_and_time.get(); }
        uint32_t major_version() const { return m_major_version; }
        uint32_t minor_version() const { return m_minor_version; }
        file_type_t type() const { return m_type; }
        file_format_t format() const { return m_format; }
        uint32_t root_key_offset() const { return m_root_key_offset; }
        uint32_t hive_bins_data_size() const { return m_hive_bins_data_size; }
        uint32_t clustering_factor() const { return m_clustering_factor; }
        std::string unknown1() const { return m_unknown1; }
        std::string unknown2() const { return m_unknown2; }
        uint32_t checksum() const { return m_checksum; }
        std::string reserved() const { return m_reserved; }
        uint32_t boot_type() const { return m_boot_type; }
        uint32_t boot_recover() const { return m_boot_recover; }
        regf_t* _root() const { return m__root; }
        regf_t* _parent() const { return m__parent; }
    };

private:
    std::unique_ptr<file_header_t> m_header;
    std::unique_ptr<std::vector<std::unique_ptr<hive_bin_t>>> m_hive_bins;
    regf_t* m__root;
    kaitai::kstruct* m__parent;
    std::unique_ptr<std::vector<std::string>> m__raw_hive_bins;
    std::unique_ptr<std::vector<std::unique_ptr<kaitai::kstream>>> m__io__raw_hive_bins;

public:
    file_header_t* header() const { return m_header.get(); }
    std::vector<std::unique_ptr<hive_bin_t>>* hive_bins() const { return m_hive_bins.get(); }
    regf_t* _root() const { return m__root; }
    kaitai::kstruct* _parent() const { return m__parent; }
    std::vector<std::string>* _raw_hive_bins() const { return m__raw_hive_bins.get(); }
    std::vector<std::unique_ptr<kaitai::kstream>>* _io__raw_hive_bins() const { return m__io__raw_hive_bins.get(); }
};

regf.cpp

// This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild

#include "regf.h"
#include "kaitai/exceptions.h"

regf_t::regf_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = this;
    m_header = nullptr;
    m_hive_bins = nullptr;
    m__raw_hive_bins = nullptr;
    m__io__raw_hive_bins = nullptr;
    _read();
}

void regf_t::_read() {
    m_header = std::unique_ptr<file_header_t>(new file_header_t(m__io, this, m__root));
    m__raw_hive_bins = std::unique_ptr<std::vector<std::string>>(new std::vector<std::string>());
    m__io__raw_hive_bins = std::unique_ptr<std::vector<std::unique_ptr<kaitai::kstream>>>(new std::vector<std::unique_ptr<kaitai::kstream>>());
    m_hive_bins = std::unique_ptr<std::vector<std::unique_ptr<hive_bin_t>>>(new std::vector<std::unique_ptr<hive_bin_t>>());
    {
        int i = 0;
        while (!m__io->is_eof()) {
            m__raw_hive_bins->push_back(std::move(m__io->read_bytes(4096)));
            kaitai::kstream* io__raw_hive_bins = new kaitai::kstream(m__raw_hive_bins->at(m__raw_hive_bins->size() - 1));
            m__io__raw_hive_bins->emplace_back(io__raw_hive_bins);
            m_hive_bins->push_back(std::move(std::unique_ptr<hive_bin_t>(new hive_bin_t(io__raw_hive_bins, this, m__root))));
            i++;
        }
    }
}

regf_t::~regf_t() {
    _clean_up();
}

void regf_t::_clean_up() {
}

regf_t::filetime_t::filetime_t(kaitai::kstream* p__io, kaitai::kstruct* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::filetime_t::_read() {
    m_value = m__io->read_u8le();
}

regf_t::filetime_t::~filetime_t() {
    _clean_up();
}

void regf_t::filetime_t::_clean_up() {
}

regf_t::hive_bin_t::hive_bin_t(kaitai::kstream* p__io, regf_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_header = nullptr;
    m_cells = nullptr;
    _read();
}

void regf_t::hive_bin_t::_read() {
    m_header = std::unique_ptr<hive_bin_header_t>(new hive_bin_header_t(m__io, this, m__root));
    m_cells = std::unique_ptr<std::vector<std::unique_ptr<hive_bin_cell_t>>>(new std::vector<std::unique_ptr<hive_bin_cell_t>>());
    {
        int i = 0;
        while (!m__io->is_eof()) {
            m_cells->push_back(std::move(std::unique_ptr<hive_bin_cell_t>(new hive_bin_cell_t(m__io, this, m__root))));
            i++;
        }
    }
}

regf_t::hive_bin_t::~hive_bin_t() {
    _clean_up();
}

void regf_t::hive_bin_t::_clean_up() {
}

regf_t::hive_bin_header_t::hive_bin_header_t(kaitai::kstream* p__io, regf_t::hive_bin_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_timestamp = nullptr;
    _read();
}

void regf_t::hive_bin_header_t::_read() {
    m_signature = m__io->read_bytes(4);
    if (!(signature() == std::string("\x68\x62\x69\x6E", 4))) {
        throw kaitai::validation_not_equal_error<std::string>(std::string("\x68\x62\x69\x6E", 4), signature(), _io(), std::string("/types/hive_bin_header/seq/0"));
    }
    m_offset = m__io->read_u4le();
    m_size = m__io->read_u4le();
    m_unknown1 = m__io->read_u4le();
    m_unknown2 = m__io->read_u4le();
    m_timestamp = std::unique_ptr<filetime_t>(new filetime_t(m__io, this, m__root));
    m_unknown4 = m__io->read_u4le();
}

regf_t::hive_bin_header_t::~hive_bin_header_t() {
    _clean_up();
}

void regf_t::hive_bin_header_t::_clean_up() {
}

regf_t::hive_bin_cell_t::hive_bin_cell_t(kaitai::kstream* p__io, regf_t::hive_bin_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m__io__raw_data = nullptr;
    f_cell_size = false;
    f_is_allocated = false;
    _read();
}

void regf_t::hive_bin_cell_t::_read() {
    m_cell_size_raw = m__io->read_s4le();
    m_identifier = kaitai::kstream::bytes_to_str(m__io->read_bytes(2), std::string("ascii"));
    n_data = true;
    {
        std::string on = identifier();
        if (on == std::string("li")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_li_t>(new sub_key_list_li_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("vk")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_vk_t>(new sub_key_list_vk_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("lf")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_lh_lf_t>(new sub_key_list_lh_lf_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("ri")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_ri_t>(new sub_key_list_ri_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("lh")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_lh_lf_t>(new sub_key_list_lh_lf_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("nk")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<named_key_t>(new named_key_t(m__io__raw_data.get(), this, m__root));
        }
        else if (on == std::string("sk")) {
            n_data = false;
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
            m__io__raw_data = std::unique_ptr<kaitai::kstream>(new kaitai::kstream(m__raw_data));
            m_data = std::unique_ptr<sub_key_list_sk_t>(new sub_key_list_sk_t(m__io__raw_data.get(), this, m__root));
        }
        else {
            m__raw_data = m__io->read_bytes(((cell_size() - 2) - 4));
        }
    }
}

regf_t::hive_bin_cell_t::~hive_bin_cell_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::_clean_up() {
    if (!n_data) {
    }
}

regf_t::hive_bin_cell_t::sub_key_list_vk_t::sub_key_list_vk_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_vk_t::_read() {
    m_value_name_size = m__io->read_u2le();
    m_data_size = m__io->read_u4le();
    m_data_offset = m__io->read_u4le();
    m_data_type = static_cast<regf_t::hive_bin_cell_t::sub_key_list_vk_t::data_type_enum_t>(m__io->read_u4le());
    m_flags = static_cast<regf_t::hive_bin_cell_t::sub_key_list_vk_t::vk_flags_t>(m__io->read_u2le());
    m_padding = m__io->read_u2le();
    n_value_name = true;
    if (flags() == regf_t::hive_bin_cell_t::sub_key_list_vk_t::VK_FLAGS_VALUE_COMP_NAME) {
        n_value_name = false;
        m_value_name = kaitai::kstream::bytes_to_str(m__io->read_bytes(value_name_size()), std::string("ascii"));
    }
}

regf_t::hive_bin_cell_t::sub_key_list_vk_t::~sub_key_list_vk_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_vk_t::_clean_up() {
    if (!n_value_name) {
    }
}

regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::sub_key_list_lh_lf_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_items = nullptr;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::_read() {
    m_count = m__io->read_u2le();
    m_items = std::unique_ptr<std::vector<std::unique_ptr<item_t>>>(new std::vector<std::unique_ptr<item_t>>());
    const int l_items = count();
    for (int i = 0; i < l_items; i++) {
        m_items->push_back(std::move(std::unique_ptr<item_t>(new item_t(m__io, this, m__root))));
    }
}

regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::~sub_key_list_lh_lf_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::item_t::item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::item_t::_read() {
    m_named_key_offset = m__io->read_u4le();
    m_hash_value = m__io->read_u4le();
}

regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::item_t::~item_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_lh_lf_t::item_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_sk_t::sub_key_list_sk_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_sk_t::_read() {
    m_unknown1 = m__io->read_u2le();
    m_previous_security_key_offset = m__io->read_u4le();
    m_next_security_key_offset = m__io->read_u4le();
    m_reference_count = m__io->read_u4le();
}

regf_t::hive_bin_cell_t::sub_key_list_sk_t::~sub_key_list_sk_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_sk_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_li_t::sub_key_list_li_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_items = nullptr;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_li_t::_read() {
    m_count = m__io->read_u2le();
    m_items = std::unique_ptr<std::vector<std::unique_ptr<item_t>>>(new std::vector<std::unique_ptr<item_t>>());
    const int l_items = count();
    for (int i = 0; i < l_items; i++) {
        m_items->push_back(std::move(std::unique_ptr<item_t>(new item_t(m__io, this, m__root))));
    }
}

regf_t::hive_bin_cell_t::sub_key_list_li_t::~sub_key_list_li_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_li_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_li_t::item_t::item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_li_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_li_t::item_t::_read() {
    m_named_key_offset = m__io->read_u4le();
}

regf_t::hive_bin_cell_t::sub_key_list_li_t::item_t::~item_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_li_t::item_t::_clean_up() {
}

regf_t::hive_bin_cell_t::named_key_t::named_key_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_last_key_written_date_and_time = nullptr;
    _read();
}

void regf_t::hive_bin_cell_t::named_key_t::_read() {
    m_flags = static_cast<regf_t::hive_bin_cell_t::named_key_t::nk_flags_t>(m__io->read_u2le());
    m_last_key_written_date_and_time = std::unique_ptr<filetime_t>(new filetime_t(m__io, this, m__root));
    m_unknown1 = m__io->read_u4le();
    m_parent_key_offset = m__io->read_u4le();
    m_number_of_sub_keys = m__io->read_u4le();
    m_number_of_volatile_sub_keys = m__io->read_u4le();
    m_sub_keys_list_offset = m__io->read_u4le();
    m_number_of_values = m__io->read_u4le();
    m_values_list_offset = m__io->read_u4le();
    m_security_key_offset = m__io->read_u4le();
    m_class_name_offset = m__io->read_u4le();
    m_largest_sub_key_name_size = m__io->read_u4le();
    m_largest_sub_key_class_name_size = m__io->read_u4le();
    m_largest_value_name_size = m__io->read_u4le();
    m_largest_value_data_size = m__io->read_u4le();
    m_unknown2 = m__io->read_u4le();
    m_key_name_size = m__io->read_u2le();
    m_class_name_size = m__io->read_u2le();
    m_unknown_string_size = m__io->read_u4le();
    m_unknown_string = kaitai::kstream::bytes_to_str(m__io->read_bytes(unknown_string_size()), std::string("ascii"));
}

regf_t::hive_bin_cell_t::named_key_t::~named_key_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::named_key_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_ri_t::sub_key_list_ri_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_items = nullptr;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_ri_t::_read() {
    m_count = m__io->read_u2le();
    m_items = std::unique_ptr<std::vector<std::unique_ptr<item_t>>>(new std::vector<std::unique_ptr<item_t>>());
    const int l_items = count();
    for (int i = 0; i < l_items; i++) {
        m_items->push_back(std::move(std::unique_ptr<item_t>(new item_t(m__io, this, m__root))));
    }
}

regf_t::hive_bin_cell_t::sub_key_list_ri_t::~sub_key_list_ri_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_ri_t::_clean_up() {
}

regf_t::hive_bin_cell_t::sub_key_list_ri_t::item_t::item_t(kaitai::kstream* p__io, regf_t::hive_bin_cell_t::sub_key_list_ri_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    _read();
}

void regf_t::hive_bin_cell_t::sub_key_list_ri_t::item_t::_read() {
    m_sub_key_list_offset = m__io->read_u4le();
}

regf_t::hive_bin_cell_t::sub_key_list_ri_t::item_t::~item_t() {
    _clean_up();
}

void regf_t::hive_bin_cell_t::sub_key_list_ri_t::item_t::_clean_up() {
}

int32_t regf_t::hive_bin_cell_t::cell_size() {
    if (f_cell_size)
        return m_cell_size;
    m_cell_size = (((cell_size_raw() < 0) ? (-1) : (1)) * cell_size_raw());
    f_cell_size = true;
    return m_cell_size;
}

bool regf_t::hive_bin_cell_t::is_allocated() {
    if (f_is_allocated)
        return m_is_allocated;
    m_is_allocated = cell_size_raw() < 0;
    f_is_allocated = true;
    return m_is_allocated;
}

regf_t::file_header_t::file_header_t(kaitai::kstream* p__io, regf_t* p__parent, regf_t* p__root) : kaitai::kstruct(p__io) {
    m__parent = p__parent;
    m__root = p__root;
    m_last_modification_date_and_time = nullptr;
    _read();
}

void regf_t::file_header_t::_read() {
    m_signature = m__io->read_bytes(4);
    if (!(signature() == std::string("\x72\x65\x67\x66", 4))) {
        throw kaitai::validation_not_equal_error<std::string>(std::string("\x72\x65\x67\x66", 4), signature(), _io(), std::string("/types/file_header/seq/0"));
    }
    m_primary_sequence_number = m__io->read_u4le();
    m_secondary_sequence_number = m__io->read_u4le();
    m_last_modification_date_and_time = std::unique_ptr<filetime_t>(new filetime_t(m__io, this, m__root));
    m_major_version = m__io->read_u4le();
    m_minor_version = m__io->read_u4le();
    m_type = static_cast<regf_t::file_header_t::file_type_t>(m__io->read_u4le());
    m_format = static_cast<regf_t::file_header_t::file_format_t>(m__io->read_u4le());
    m_root_key_offset = m__io->read_u4le();
    m_hive_bins_data_size = m__io->read_u4le();
    m_clustering_factor = m__io->read_u4le();
    m_unknown1 = m__io->read_bytes(64);
    m_unknown2 = m__io->read_bytes(396);
    m_checksum = m__io->read_u4le();
    m_reserved = m__io->read_bytes(3576);
    m_boot_type = m__io->read_u4le();
    m_boot_recover = m__io->read_u4le();
}

regf_t::file_header_t::~file_header_t() {
    _clean_up();
}

void regf_t::file_header_t::_clean_up() {
}