在網上找了一圈。。也沒有找到相關的資料。。一點都沒有。。。? 還有有大米公開的代碼供參考。。。 趕緊把學習的成果記錄下來。。

CM_KEY_NODE 的結構：

?+0x014 SubKeyCounts????? : [2] Uint4B???????????????? //SubKeyCounts[0] 子鍵的個數

?+0x01c SubKeyLists?????? : [2] Uint4B????????????? //SubKeyLists[0] 子鍵列表相差本 BIN 的偏移

這里的subKeyList是一個偏移。。指向 CM_KEY_INDEX結構。。最復雜的也是這個結構。。

他有好幾種變形。。。

可以是：

lf 結構

??? + lf

????+lh

li 結構

ri 結構

可以根據 signature判斷當前的index 屬于那種結構。。對于每一種結構都有對應的 格式

struct lf_key {

? short id;???????? /* 0x0000?Word?ID: ASCII-"lf" = 0x666C or "lh" = 0x686c */
? short no_keys;??? /* 0x0002?Word?number of keys????????? */
??????????????????? /* 0x0004??????Hash-Records??????????? */
?
?union {

??? struct lf_hash {
????? long ofs_nk;??? /* 0x0000?D-Word?Offset of corresponding "nk"-Record? */
????? char name[4];?? /* 0x0004?D-Word?ASCII: the first 4 characters of the key-name,? */
??? } hash[1];

????? /* WinXP uses a more real hash instead (base 37 of uppercase name chars)? */
????? /* ??padded with 0's. Case sensitiv!???????????????????????? */

??? struct lh_hash {
????? long ofs_nk;??? /* 0x0000?D-Word?Offset of corresponding "nk"-Record? */
????? long hash;????? /* 0x0004?D-Word?ASCII: the first 4 characters of the key-name,? */
??? } lh_hash[1];
? };

};

/* 3.x version of the above, contains only offset table, NOT
?* any start of names "hash". Thus needs 'nk' lookups for searches.
?*/
struct li_key {

? short id;???????? /* 0x0000?Word?ID: ASCII-"li" = 0x696C */
? short no_keys;??? /* 0x0002?Word?number of keys????????? */
??????????????????? /* 0x0004??????Hash-Records??????????? */
? struct li_hash {
??? long ofs_nk;??? /* 0x0000?D-Word?Offset of corresponding "nk"-Record? */
? } hash[1];
};

/* This is a list of pointers to struct li_key, ie
?* an extention record if many li's.
?* This happens in NT4&5 when the lf hashlist grows larger
?* than about 400-500 entries/subkeys??, then the nk_key->ofs_lf points to this
?* instead of directly to an lf.
?* The sub-indices this points to seems to be li (yes!) in NT4 and 2k.
?* In XP and newer they point to lh which is more efficient.
?* Likely to happen in HKLM\Software\classes (file extention list) and
?* in SAM when many users.
?*/
struct ri_key {

? short id;???????? /* 0x0000?Word?ID: ASCII-"ri" = 0x6972 */
? short no_lis;??? /* 0x0002?Word?number of pointers to li */
??????????????????? /* 0x0004??????Hash-Records??????????? */
? struct ri_hash {
????? long ofs_li;??? /* 0x0000?D-Word?Offset of corresponding "li"-Record? */
? } hash[1];
};

?

當subkey的數量大約500時。。是ri結構。。ri結構保存了li結構或lf結構的索引。。

?

枚舉一個Key的subKey的code：

?

?

如果沒有ri結構：找到subkey的 CM_Key_NODE結構的過程是這樣的：

????????????????????????????????????????????????? index.hash[i].ofs_nk

1.subKeyList--------》index結構----------------------------》key_Node

?

有ri結構：

???????????????????????????????????????????????????????? rikey->hash[r].ofs_li????????????????????????????index.hash[i].ofs_nk???

subkeylist ----------------> ri_index--------------------------------->li/lf結構----------------------------------》 Key_node

?

真日啊 。。。費勁。。

?

?

?

?

?

?

?

?

?

hive中的subkeylist的結構詳解。。