First and foremost - awesome library, beautiful code. Thank you!

If I may be so bold as to make my first post to the mailing list a request for an API change, I have attached a patch for a new function in the hivex library that implements obtaining a handle to a "deep" node, allowing the user to enter a path like "SOFTWARE\Intel\Infinst\Uninstall" with only a previous call to load the root of, say, HKLM. When I first used libhivex, I assumed hivex_node_get_child would take such a path, but then learned that it only scans the children of the current node for a match.

I do realize that hivex_node_get_child has a O(n) where n is the number of keys in the node and this means hivex_node_get_child_deep has a O(mn) where m is the number of \-separated paths; but the extra *m overhead is always going to be there when iterating through a registry hive.

I tried to stick to the coding conventions as close as possible, and to keep the changes to a minimal. Please note that I was not sure where the function prototype should be declared so as to get it exported in hivex.h, that is something that will need to be added to my patch (please).

I apologize for not taking the time to ask whether or not such a new API function would be welcome. As it was, I needed this code for my own purposes, so I am sharing it here on the mailing list in case it proves to be helpful to anyone else.

Thank you,

Mahmoud Al-Qudsi
NeoSmart Technologies