source: releases/0.10.0/include/regfi.h@ 293

Last change on this file since 293 was 140, checked in by tim, 16 years ago

Misc error message changes.

Added and removed some comments.

Updated TODO list.
  • Property svn:keywords set to Id
File size: 16.3 KB
Line 
1/*
2 * Branched from Samba project Subversion repository, version #6903:
3 * http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Windows NT (and later) registry parsing library
6 *
7 * Copyright (C) 2005-2009 Timothy D. Morgan
8 * Copyright (C) 2005 Gerald (Jerry) Carter
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; version 3 of the License.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 *
23 * $Id: regfi.h 140 2009-02-09 19:53:39Z tim $
24 */
25
26/************************************************************
27 * Most of this information was obtained from
28 * http://www.wednesday.demon.co.uk/dosreg.html
29 * Thanks Nigel!
30 ***********************************************************/
31
32#ifndef _REGFI_H
33#define _REGFI_H
34
35#include <stdlib.h>
36#include <stdio.h>
37#include <stdbool.h>
38#include <stdarg.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "winsec.h"
50#include "void_stack.h"
51#include "range_list.h"
52#include "lru_cache.h"
53
54/******************************************************************************/
55
56/* regfi library error message types */
57#define REGFI_MSG_INFO 0x0001
58#define REGFI_MSG_WARN 0x0004
59#define REGFI_MSG_ERROR 0x0010
60
61/* Registry data types */
62#define REG_NONE 0
63#define REG_SZ 1
64#define REG_EXPAND_SZ 2
65#define REG_BINARY 3
66#define REG_DWORD 4
67#define REG_DWORD_LE 4 /* DWORD, little endian */
68#define REG_DWORD_BE 5 /* DWORD, big endian */
69#define REG_LINK 6
70#define REG_MULTI_SZ 7
71#define REG_RESOURCE_LIST 8
72#define REG_FULL_RESOURCE_DESCRIPTOR 9
73#define REG_RESOURCE_REQUIREMENTS_LIST 10
74#define REG_QWORD 11 /* 64-bit little endian */
75/* XXX: Has MS defined a REG_QWORD_BE? */
76/* Not a real type in the registry */
77#define REG_KEY 0x7FFFFFFF
78
79#define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */
80#define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */
81#define REGFI_MAX_DEPTH 512
82#define REGFI_OFFSET_NONE 0xffffffff
83
84/* XXX: This is totally arbitrary right now. */
85#define REGFI_MAX_SUBKEY_DEPTH 255
86
87/* Header sizes and magic number lengths for various records */
88#define REGFI_REGF_MAGIC_SIZE 4
89#define REGFI_HBIN_MAGIC_SIZE 4
90#define REGFI_CELL_MAGIC_SIZE 2
91#define REGFI_HBIN_HEADER_SIZE 0x20
92#define REGFI_NK_MIN_LENGTH 0x4C
93#define REGFI_VK_MIN_LENGTH 0x14
94#define REGFI_SK_MIN_LENGTH 0x14
95#define REGFI_SUBKEY_LIST_MIN_LEN 0x4
96
97
98/* Constants used for validation */
99/* XXX: Can we add clock resolution validation as well as range? It has
100 * been reported that Windows timestamps are never more than a
101 * certain granularity (250ms?), which could be used to help
102 * eliminate false positives. Would need to validate this and
103 * perhaps conservatively implement a check.
104 */
105 /* Minimum time is Jan 1, 1990 00:00:00 */
106#define REGFI_MTIME_MIN_HIGH 0x01B41E6D
107#define REGFI_MTIME_MIN_LOW 0x26F98000
108 /* Maximum time is Jan 1, 2290 00:00:00
109 * (We hope no one is using Windows by then...)
110 */
111#define REGFI_MTIME_MAX_HIGH 0x03047543
112#define REGFI_MTIME_MAX_LOW 0xC80A4000
113
114
115/* Flags for the vk records */
116#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
117#define REGFI_VK_DATA_IN_OFFSET 0x80000000
118#define REGFI_VK_MAX_DATA_LENGTH 1024*1024
119
120
121/* NK record types */
122/* XXX: This is starting to look like this is a flags field.
123 * Need to decipher the meaning of each flag.
124 */
125#define REGFI_NK_TYPE_LINKKEY 0x0010
126#define REGFI_NK_TYPE_NORMALKEY 0x0020
127 /* XXX: Unknown key type that shows up in Vista registries */
128#define REGFI_NK_TYPE_UNKNOWN1 0x1020
129 /* XXX: Unknown key types that shows up in W2K3 registries */
130#define REGFI_NK_TYPE_UNKNOWN2 0x4020
131#define REGFI_NK_TYPE_UNKNOWN3 0x0000 /* XXX: This type seems to have UTF-16 names!!! */
132#define REGFI_NK_TYPE_ROOTKEY1 0x002c
133 /* XXX: Unknown root key type that shows up in Vista registries */
134#define REGFI_NK_TYPE_ROOTKEY2 0x00ac
135
136#if 0
137/* Initial hypothesis of NK flags: */
138/***********************************/
139#define REGFI_NK_FLAG_LINK 0x0010
140/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
141#define REGFI_NK_FLAG_ASCIINAME 0x0020
142/* These next two combine to form the "c" on both known root key types */
143#define REGFI_NK_FLAG_ROOT1 0x0008
144#define REGFI_NK_FLAG_ROOT2 0x0004
145/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
146#define REGFI_NK_FLAG_UNKNOWN1 0x4000
147#define REGFI_NK_FLAG_UNKNOWN2 0x1000
148/* This next one shows up on root keys in some Vista "software" registries */
149#define REGFI_NK_FLAG_UNKNOWN3 0x0080
150#endif
151
152
153
154/* HBIN block */
155typedef struct _regfi_hbin
156{
157 uint32 file_off; /* my offset in the registry file */
158 uint32 ref_count; /* how many active records are pointing to this
159 * block (not used currently)
160 */
161
162 uint32 first_hbin_off; /* offset from first hbin block */
163 uint32 block_size; /* block size of this block
164 * Should be a multiple of 4096 (0x1000)
165 */
166 uint32 next_block; /* relative offset to next block.
167 * NOTE: This value may be unreliable!
168 */
169
170 uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
171} REGFI_HBIN;
172
173
174/* Subkey List -- list of key offsets and hashed names for consistency */
175typedef struct
176{
177 /* Virtual offset of NK record or additional subkey list,
178 * depending on this list's type.
179 */
180 uint32 offset;
181
182 uint32 hash;
183} REGFI_SUBKEY_LIST_ELEM;
184
185
186typedef struct
187{
188 /* Real offset of this record's cell in the file */
189 uint32 offset;
190
191 uint32 cell_size;
192
193 /* Number of immediate children */
194 uint32 num_children;
195
196 /* Total number of keys referenced by this list and it's children */
197 uint32 num_keys;
198
199 REGFI_SUBKEY_LIST_ELEM* elements;
200 uint8 magic[REGFI_CELL_MAGIC_SIZE];
201
202 /* Set if the magic indicates this subkey list points to child subkey lists */
203 bool recursive_type;
204} REGFI_SUBKEY_LIST;
205
206
207/* Key Value */
208typedef struct
209{
210 uint32 offset; /* Real offset of this record's cell in the file */
211 uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
212
213 REGFI_HBIN* hbin; /* pointer to HBIN record (in memory) containing
214 * this nk record
215 */
216 uint8* data;
217 uint16 name_length;
218 char* valuename;
219 uint32 hbin_off; /* offset from beginning of this hbin block */
220
221 uint32 data_size;
222 uint32 data_off; /* offset of data cell (virtual) */
223 uint32 type;
224 uint8 magic[REGFI_CELL_MAGIC_SIZE];
225 uint16 flag;
226 uint16 unknown1;
227 bool data_in_offset;
228} REGFI_VK_REC;
229
230
231/* Key Security */
232struct _regfi_sk_rec;
233
234typedef struct _regfi_sk_rec
235{
236 uint32 offset; /* Real file offset of this record */
237 uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
238
239 WINSEC_DESC* sec_desc;
240 uint32 hbin_off; /* offset from beginning of this hbin block */
241
242 uint32 sk_off; /* offset parsed from NK record used as a key
243 * to lookup reference to this SK record
244 */
245
246 uint32 prev_sk_off;
247 uint32 next_sk_off;
248 uint32 ref_count;
249 uint32 desc_size; /* size of security descriptor */
250 uint16 unknown_tag;
251 uint8 magic[REGFI_CELL_MAGIC_SIZE];
252} REGFI_SK_REC;
253
254
255/* Key Name */
256typedef struct
257{
258 uint32 offset; /* Real offset of this record's cell in the file */
259 uint32 cell_size; /* Actual or estimated length of the cell.
260 * Always in multiples of 8.
261 */
262
263 /* link in the other records here */
264 REGFI_VK_REC** values;
265 REGFI_SUBKEY_LIST* subkeys;
266
267 /* header information */
268 uint16 key_type;
269 uint8 magic[REGFI_CELL_MAGIC_SIZE];
270 NTTIME mtime;
271 uint16 name_length;
272 uint16 classname_length;
273 char* classname;
274 char* keyname;
275 uint32 parent_off; /* pointer to parent key */
276 uint32 classname_off;
277
278 /* max lengths */
279 uint32 max_bytes_subkeyname; /* max subkey name * 2 */
280 uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
281 uint32 max_bytes_valuename; /* max valuename * 2 */
282 uint32 max_bytes_value; /* max value data size */
283
284 /* unknowns */
285 uint32 unknown1;
286 uint32 unknown2;
287 uint32 unknown3;
288 uint32 unk_index; /* nigel says run time index ? */
289
290 /* children */
291 uint32 num_subkeys;
292 uint32 subkeys_off; /* offset of subkey list that points to NK records */
293 uint32 num_values;
294 uint32 values_off; /* value lists which point to VK records */
295 uint32 sk_off; /* offset to SK record */
296} REGFI_NK_REC;
297
298
299
300/* REGF block */
301typedef struct
302{
303 /* Run-time information */
304 /************************/
305 /* file descriptor */
306 int fd;
307
308 /* For sanity checking (not part of the registry header) */
309 uint32 file_length;
310
311 /* Metadata about hbins */
312 range_list* hbins;
313
314 /* Error/warning/info messages returned by lower layer functions */
315 char* last_message;
316
317 /* Mask for error message types that will be stored. */
318 uint16 msg_mask;
319
320
321 /* Data parsed from file header */
322 /********************************/
323 uint8 magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
324 NTTIME mtime;
325 uint32 data_offset; /* offset to record in the first (or any?)
326 * hbin block
327 */
328 uint32 last_block; /* offset to last hbin block in file */
329
330 uint32 checksum; /* Stored checksum. */
331 uint32 computed_checksum; /* Our own calculation of the checksum.
332 * (XOR of bytes 0x0000 - 0x01FB)
333 */
334
335 /* XXX: Some of these we have some clues about (major/minor version, etc).
336 * Should verify and update names accordingly.
337 */
338 /* unknown data structure values */
339 uint32 unknown1;
340 uint32 unknown2;
341 uint32 unknown3;
342 uint32 unknown4;
343 uint32 unknown5;
344 uint32 unknown6;
345 uint32 unknown7;
346} REGFI_FILE;
347
348
349/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
350 * structure, probably REGFI_FILE. Once key caching is in place,
351 * convert key_positions stack to store just key offsets rather than
352 * whole keys.
353 */
354typedef struct
355{
356 REGFI_FILE* f;
357 void_stack* key_positions;
358 lru_cache* sk_recs;
359 REGFI_NK_REC* cur_key;
360 uint32 cur_subkey;
361 uint32 cur_value;
362} REGFI_ITERATOR;
363
364
365typedef struct
366{
367 /* XXX: Should probably eliminate the storage of keys here
368 * once key caching is implemented.
369 */
370 REGFI_NK_REC* nk;
371 uint32 cur_subkey;
372 /* We could store a cur_value here as well, but didn't see
373 * the use in it right now.
374 */
375} REGFI_ITER_POSITION;
376
377
378/******************************************************************************/
379/* Main iterator API */
380/******************************************************************************/
381REGFI_FILE* regfi_open(const char* filename);
382int regfi_close(REGFI_FILE* r);
383
384/* regfi_get_messages: Get errors, warnings, and/or verbose information
385 * relating to processing of the given registry file.
386 *
387 * Arguments:
388 * file -- the structure for the registry file
389 *
390 * Returns:
391 * A newly allocated char* which must be free()d by the caller.
392 */
393char* regfi_get_messages(REGFI_FILE* file);
394void regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
395
396REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* fh);
397void regfi_iterator_free(REGFI_ITERATOR* i);
398bool regfi_iterator_down(REGFI_ITERATOR* i);
399bool regfi_iterator_up(REGFI_ITERATOR* i);
400bool regfi_iterator_to_root(REGFI_ITERATOR* i);
401
402bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
403 const char* subkey_name);
404bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
405 const char** path);
406const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
407const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
408const REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
409const REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
410const REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
411
412bool regfi_iterator_find_value(REGFI_ITERATOR* i,
413 const char* value_name);
414const REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
415const REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
416const REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
417
418
419/********************************************************/
420/* Middle-layer structure caching, loading, and linking */
421/********************************************************/
422REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
423REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32 offset,
424 bool strict);
425REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
426 uint32 num_keys, uint32 max_size,
427 bool strict);
428REGFI_VK_REC** regfi_load_valuelist(REGFI_FILE* file, uint32 offset,
429 uint32 num_values, uint32 max_size,
430 bool strict);
431
432/************************************/
433/* Low-layer data structure access */
434/************************************/
435REGFI_FILE* regfi_parse_regf(int fd, bool strict);
436REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32 offset,
437 bool strict);
438
439
440/* regfi_parse_nk: Parses an NK record.
441 *
442 * Arguments:
443 * f -- the registry file structure
444 * offset -- the offset of the cell (not the record) to be parsed.
445 * max_size -- the maximum size the NK cell could be. (for validation)
446 * strict -- if true, rejects any malformed records. Otherwise,
447 * tries to minimally validate integrity.
448 * Returns:
449 * A newly allocated NK record structure, or NULL on failure.
450 */
451REGFI_NK_REC* regfi_parse_nk(REGFI_FILE* file, uint32 offset,
452 uint32 max_size, bool strict);
453
454REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
455 uint32 max_size, bool strict);
456
457REGFI_VK_REC* regfi_parse_vk(REGFI_FILE* file, uint32 offset,
458 uint32 max_size, bool strict);
459
460uint8* regfi_parse_data(REGFI_FILE* file, uint32 offset,
461 uint32 length, uint32 max_size,
462 bool strict);
463
464REGFI_SK_REC* regfi_parse_sk(REGFI_FILE* file, uint32 offset,
465 uint32 max_size, bool strict);
466
467range_list* regfi_parse_unalloc_cells(REGFI_FILE* file);
468
469bool regfi_parse_cell(int fd, uint32 offset,
470 uint8* hdr, uint32 hdr_len,
471 uint32* cell_length, bool* unalloc);
472
473char* regfi_parse_classname(REGFI_FILE* file, uint32 offset,
474 uint16* name_length,
475 uint32 max_size, bool strict);
476
477
478/************************************/
479/* Private Functions */
480/************************************/
481REGFI_NK_REC* regfi_rootkey(REGFI_FILE* file);
482void regfi_key_free(REGFI_NK_REC* nk);
483void regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
484uint32 regfi_read(int fd, uint8* buf, uint32* length);
485
486const char* regfi_type_val2str(unsigned int val);
487int regfi_type_str2val(const char* str);
488
489char* regfi_get_sacl(WINSEC_DESC* sec_desc);
490char* regfi_get_dacl(WINSEC_DESC* sec_desc);
491char* regfi_get_owner(WINSEC_DESC* sec_desc);
492char* regfi_get_group(WINSEC_DESC* sec_desc);
493
494REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists,
495 REGFI_SUBKEY_LIST** lists,
496 bool strict);
497REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
498 uint32 max_size, bool strict,
499 uint8 depth_left);
500void regfi_add_message(REGFI_FILE* file, uint16 msg_type,
501 const char* fmt, ...);
502#endif /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.