Context Navigation

regfi.h @ 273

Last change on this file since 273 was 140, checked in by tim, 16 years ago

Misc error message changes.

Added and removed some comments.

Updated TODO list.

Property svn:keywords set to Id

File size: 16.3 KB

Line
1	/*
2	* Branched from Samba project Subversion repository, version #6903:
3	* http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4	*
5	* Windows NT (and later) registry parsing library
6	*
7	* Copyright (C) 2005-2009 Timothy D. Morgan
8	* Copyright (C) 2005 Gerald (Jerry) Carter
9	*
10	* This program is free software; you can redistribute it and/or modify
11	* it under the terms of the GNU General Public License as published by
12	* the Free Software Foundation; version 3 of the License.
13	*
14	* This program is distributed in the hope that it will be useful,
15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	* GNU General Public License for more details.
18	*
19	* You should have received a copy of the GNU General Public License
20	* along with this program; if not, write to the Free Software
21	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22	*
23	* $Id: regfi.h 140 2009-02-09 19:53:39Z tim $
24	*/
25
26	/************************************************************
27	* Most of this information was obtained from
28	* http://www.wednesday.demon.co.uk/dosreg.html
29	* Thanks Nigel!
30	***********************************************************/
31
32	#ifndef _REGFI_H
33	#define _REGFI_H
34
35	#include <stdlib.h>
36	#include <stdio.h>
37	#include <stdbool.h>
38	#include <stdarg.h>
39	#include <string.h>
40	#include <errno.h>
41	#include <time.h>
42	#include <fcntl.h>
43	#include <sys/stat.h>
44	#include <sys/types.h>
45	#include <unistd.h>
46	#include <assert.h>
47
48	#include "smb_deps.h"
49	#include "winsec.h"
50	#include "void_stack.h"
51	#include "range_list.h"
52	#include "lru_cache.h"
53
54	/******************************************************************************/
55
56	/* regfi library error message types */
57	#define REGFI_MSG_INFO 0x0001
58	#define REGFI_MSG_WARN 0x0004
59	#define REGFI_MSG_ERROR 0x0010
60
61	/* Registry data types */
62	#define REG_NONE 0
63	#define REG_SZ 1
64	#define REG_EXPAND_SZ 2
65	#define REG_BINARY 3
66	#define REG_DWORD 4
67	#define REG_DWORD_LE 4 /* DWORD, little endian */
68	#define REG_DWORD_BE 5 /* DWORD, big endian */
69	#define REG_LINK 6
70	#define REG_MULTI_SZ 7
71	#define REG_RESOURCE_LIST 8
72	#define REG_FULL_RESOURCE_DESCRIPTOR 9
73	#define REG_RESOURCE_REQUIREMENTS_LIST 10
74	#define REG_QWORD 11 /* 64-bit little endian */
75	/* XXX: Has MS defined a REG_QWORD_BE? */
76	/* Not a real type in the registry */
77	#define REG_KEY 0x7FFFFFFF
78
79	#define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */
80	#define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */
81	#define REGFI_MAX_DEPTH 512
82	#define REGFI_OFFSET_NONE 0xffffffff
83
84	/* XXX: This is totally arbitrary right now. */
85	#define REGFI_MAX_SUBKEY_DEPTH 255
86
87	/* Header sizes and magic number lengths for various records */
88	#define REGFI_REGF_MAGIC_SIZE 4
89	#define REGFI_HBIN_MAGIC_SIZE 4
90	#define REGFI_CELL_MAGIC_SIZE 2
91	#define REGFI_HBIN_HEADER_SIZE 0x20
92	#define REGFI_NK_MIN_LENGTH 0x4C
93	#define REGFI_VK_MIN_LENGTH 0x14
94	#define REGFI_SK_MIN_LENGTH 0x14
95	#define REGFI_SUBKEY_LIST_MIN_LEN 0x4
96
97
98	/* Constants used for validation */
99	/* XXX: Can we add clock resolution validation as well as range? It has
100	* been reported that Windows timestamps are never more than a
101	* certain granularity (250ms?), which could be used to help
102	* eliminate false positives. Would need to validate this and
103	* perhaps conservatively implement a check.
104	*/
105	/* Minimum time is Jan 1, 1990 00:00:00 */
106	#define REGFI_MTIME_MIN_HIGH 0x01B41E6D
107	#define REGFI_MTIME_MIN_LOW 0x26F98000
108	/* Maximum time is Jan 1, 2290 00:00:00
109	* (We hope no one is using Windows by then...)
110	*/
111	#define REGFI_MTIME_MAX_HIGH 0x03047543
112	#define REGFI_MTIME_MAX_LOW 0xC80A4000
113
114
115	/* Flags for the vk records */
116	#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
117	#define REGFI_VK_DATA_IN_OFFSET 0x80000000
118	#define REGFI_VK_MAX_DATA_LENGTH 1024*1024
119
120
121	/* NK record types */
122	/* XXX: This is starting to look like this is a flags field.
123	* Need to decipher the meaning of each flag.
124	*/
125	#define REGFI_NK_TYPE_LINKKEY 0x0010
126	#define REGFI_NK_TYPE_NORMALKEY 0x0020
127	/* XXX: Unknown key type that shows up in Vista registries */
128	#define REGFI_NK_TYPE_UNKNOWN1 0x1020
129	/* XXX: Unknown key types that shows up in W2K3 registries */
130	#define REGFI_NK_TYPE_UNKNOWN2 0x4020
131	#define REGFI_NK_TYPE_UNKNOWN3 0x0000 /* XXX: This type seems to have UTF-16 names!!! */
132	#define REGFI_NK_TYPE_ROOTKEY1 0x002c
133	/* XXX: Unknown root key type that shows up in Vista registries */
134	#define REGFI_NK_TYPE_ROOTKEY2 0x00ac
135
136	#if 0
137	/* Initial hypothesis of NK flags: */
138	/***********************************/
139	#define REGFI_NK_FLAG_LINK 0x0010
140	/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
141	#define REGFI_NK_FLAG_ASCIINAME 0x0020
142	/* These next two combine to form the "c" on both known root key types */
143	#define REGFI_NK_FLAG_ROOT1 0x0008
144	#define REGFI_NK_FLAG_ROOT2 0x0004
145	/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
146	#define REGFI_NK_FLAG_UNKNOWN1 0x4000
147	#define REGFI_NK_FLAG_UNKNOWN2 0x1000
148	/* This next one shows up on root keys in some Vista "software" registries */
149	#define REGFI_NK_FLAG_UNKNOWN3 0x0080
150	#endif
151
152
153
154	/* HBIN block */
155	typedef struct _regfi_hbin
156	{
157	uint32 file_off; /* my offset in the registry file */
158	uint32 ref_count; /* how many active records are pointing to this
159	* block (not used currently)
160	*/
161
162	uint32 first_hbin_off; /* offset from first hbin block */
163	uint32 block_size; /* block size of this block
164	* Should be a multiple of 4096 (0x1000)
165	*/
166	uint32 next_block; /* relative offset to next block.
167	* NOTE: This value may be unreliable!
168	*/
169
170	uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
171	} REGFI_HBIN;
172
173
174	/* Subkey List -- list of key offsets and hashed names for consistency */
175	typedef struct
176	{
177	/* Virtual offset of NK record or additional subkey list,
178	* depending on this list's type.
179	*/
180	uint32 offset;
181
182	uint32 hash;
183	} REGFI_SUBKEY_LIST_ELEM;
184
185
186	typedef struct
187	{
188	/* Real offset of this record's cell in the file */
189	uint32 offset;
190
191	uint32 cell_size;
192
193	/* Number of immediate children */
194	uint32 num_children;
195
196	/* Total number of keys referenced by this list and it's children */
197	uint32 num_keys;
198
199	REGFI_SUBKEY_LIST_ELEM* elements;
200	uint8 magic[REGFI_CELL_MAGIC_SIZE];
201
202	/* Set if the magic indicates this subkey list points to child subkey lists */
203	bool recursive_type;
204	} REGFI_SUBKEY_LIST;
205
206
207	/* Key Value */
208	typedef struct
209	{
210	uint32 offset; /* Real offset of this record's cell in the file */
211	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
212
213	REGFI_HBIN* hbin; /* pointer to HBIN record (in memory) containing
214	* this nk record
215	*/
216	uint8* data;
217	uint16 name_length;
218	char* valuename;
219	uint32 hbin_off; /* offset from beginning of this hbin block */
220
221	uint32 data_size;
222	uint32 data_off; /* offset of data cell (virtual) */
223	uint32 type;
224	uint8 magic[REGFI_CELL_MAGIC_SIZE];
225	uint16 flag;
226	uint16 unknown1;
227	bool data_in_offset;
228	} REGFI_VK_REC;
229
230
231	/* Key Security */
232	struct _regfi_sk_rec;
233
234	typedef struct _regfi_sk_rec
235	{
236	uint32 offset; /* Real file offset of this record */
237	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
238
239	WINSEC_DESC* sec_desc;
240	uint32 hbin_off; /* offset from beginning of this hbin block */
241
242	uint32 sk_off; /* offset parsed from NK record used as a key
243	* to lookup reference to this SK record
244	*/
245
246	uint32 prev_sk_off;
247	uint32 next_sk_off;
248	uint32 ref_count;
249	uint32 desc_size; /* size of security descriptor */
250	uint16 unknown_tag;
251	uint8 magic[REGFI_CELL_MAGIC_SIZE];
252	} REGFI_SK_REC;
253
254
255	/* Key Name */
256	typedef struct
257	{
258	uint32 offset; /* Real offset of this record's cell in the file */
259	uint32 cell_size; /* Actual or estimated length of the cell.
260	* Always in multiples of 8.
261	*/
262
263	/* link in the other records here */
264	REGFI_VK_REC** values;
265	REGFI_SUBKEY_LIST* subkeys;
266
267	/* header information */
268	uint16 key_type;
269	uint8 magic[REGFI_CELL_MAGIC_SIZE];
270	NTTIME mtime;
271	uint16 name_length;
272	uint16 classname_length;
273	char* classname;
274	char* keyname;
275	uint32 parent_off; /* pointer to parent key */
276	uint32 classname_off;
277
278	/* max lengths */
279	uint32 max_bytes_subkeyname; /* max subkey name * 2 */
280	uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
281	uint32 max_bytes_valuename; /* max valuename * 2 */
282	uint32 max_bytes_value; /* max value data size */
283
284	/* unknowns */
285	uint32 unknown1;
286	uint32 unknown2;
287	uint32 unknown3;
288	uint32 unk_index; /* nigel says run time index ? */
289
290	/* children */
291	uint32 num_subkeys;
292	uint32 subkeys_off; /* offset of subkey list that points to NK records */
293	uint32 num_values;
294	uint32 values_off; /* value lists which point to VK records */
295	uint32 sk_off; /* offset to SK record */
296	} REGFI_NK_REC;
297
298
299
300	/* REGF block */
301	typedef struct
302	{
303	/* Run-time information */
304	/************************/
305	/* file descriptor */
306	int fd;
307
308	/* For sanity checking (not part of the registry header) */
309	uint32 file_length;
310
311	/* Metadata about hbins */
312	range_list* hbins;
313
314	/* Error/warning/info messages returned by lower layer functions */
315	char* last_message;
316
317	/* Mask for error message types that will be stored. */
318	uint16 msg_mask;
319
320
321	/* Data parsed from file header */
322	/********************************/
323	uint8 magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
324	NTTIME mtime;
325	uint32 data_offset; /* offset to record in the first (or any?)
326	* hbin block
327	*/
328	uint32 last_block; /* offset to last hbin block in file */
329
330	uint32 checksum; /* Stored checksum. */
331	uint32 computed_checksum; /* Our own calculation of the checksum.
332	* (XOR of bytes 0x0000 - 0x01FB)
333	*/
334
335	/* XXX: Some of these we have some clues about (major/minor version, etc).
336	* Should verify and update names accordingly.
337	*/
338	/* unknown data structure values */
339	uint32 unknown1;
340	uint32 unknown2;
341	uint32 unknown3;
342	uint32 unknown4;
343	uint32 unknown5;
344	uint32 unknown6;
345	uint32 unknown7;
346	} REGFI_FILE;
347
348
349	/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
350	* structure, probably REGFI_FILE. Once key caching is in place,
351	* convert key_positions stack to store just key offsets rather than
352	* whole keys.
353	*/
354	typedef struct
355	{
356	REGFI_FILE* f;
357	void_stack* key_positions;
358	lru_cache* sk_recs;
359	REGFI_NK_REC* cur_key;
360	uint32 cur_subkey;
361	uint32 cur_value;
362	} REGFI_ITERATOR;
363
364
365	typedef struct
366	{
367	/* XXX: Should probably eliminate the storage of keys here
368	* once key caching is implemented.
369	*/
370	REGFI_NK_REC* nk;
371	uint32 cur_subkey;
372	/* We could store a cur_value here as well, but didn't see
373	* the use in it right now.
374	*/
375	} REGFI_ITER_POSITION;
376
377
378	/******************************************************************************/
379	/* Main iterator API */
380	/******************************************************************************/
381	REGFI_FILE* regfi_open(const char* filename);
382	int regfi_close(REGFI_FILE* r);
383
384	/* regfi_get_messages: Get errors, warnings, and/or verbose information
385	* relating to processing of the given registry file.
386	*
387	* Arguments:
388	* file -- the structure for the registry file
389	*
390	* Returns:
391	* A newly allocated char* which must be free()d by the caller.
392	*/
393	char* regfi_get_messages(REGFI_FILE* file);
394	void regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
395
396	REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* fh);
397	void regfi_iterator_free(REGFI_ITERATOR* i);
398	bool regfi_iterator_down(REGFI_ITERATOR* i);
399	bool regfi_iterator_up(REGFI_ITERATOR* i);
400	bool regfi_iterator_to_root(REGFI_ITERATOR* i);
401
402	bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
403	const char* subkey_name);
404	bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
405	const char** path);
406	const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
407	const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
408	const REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
409	const REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
410	const REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
411
412	bool regfi_iterator_find_value(REGFI_ITERATOR* i,
413	const char* value_name);
414	const REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
415	const REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
416	const REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
417
418
419	/********************************************************/
420	/* Middle-layer structure caching, loading, and linking */
421	/********************************************************/
422	REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
423	REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32 offset,
424	bool strict);
425	REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
426	uint32 num_keys, uint32 max_size,
427	bool strict);
428	REGFI_VK_REC** regfi_load_valuelist(REGFI_FILE* file, uint32 offset,
429	uint32 num_values, uint32 max_size,
430	bool strict);
431
432	/************************************/
433	/* Low-layer data structure access */
434	/************************************/
435	REGFI_FILE* regfi_parse_regf(int fd, bool strict);
436	REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32 offset,
437	bool strict);
438
439
440	/* regfi_parse_nk: Parses an NK record.
441	*
442	* Arguments:
443	* f -- the registry file structure
444	* offset -- the offset of the cell (not the record) to be parsed.
445	* max_size -- the maximum size the NK cell could be. (for validation)
446	* strict -- if true, rejects any malformed records. Otherwise,
447	* tries to minimally validate integrity.
448	* Returns:
449	* A newly allocated NK record structure, or NULL on failure.
450	*/
451	REGFI_NK_REC* regfi_parse_nk(REGFI_FILE* file, uint32 offset,
452	uint32 max_size, bool strict);
453
454	REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
455	uint32 max_size, bool strict);
456
457	REGFI_VK_REC* regfi_parse_vk(REGFI_FILE* file, uint32 offset,
458	uint32 max_size, bool strict);
459
460	uint8* regfi_parse_data(REGFI_FILE* file, uint32 offset,
461	uint32 length, uint32 max_size,
462	bool strict);
463
464	REGFI_SK_REC* regfi_parse_sk(REGFI_FILE* file, uint32 offset,
465	uint32 max_size, bool strict);
466
467	range_list* regfi_parse_unalloc_cells(REGFI_FILE* file);
468
469	bool regfi_parse_cell(int fd, uint32 offset,
470	uint8* hdr, uint32 hdr_len,
471	uint32* cell_length, bool* unalloc);
472
473	char* regfi_parse_classname(REGFI_FILE* file, uint32 offset,
474	uint16* name_length,
475	uint32 max_size, bool strict);
476
477
478	/************************************/
479	/* Private Functions */
480	/************************************/
481	REGFI_NK_REC* regfi_rootkey(REGFI_FILE* file);
482	void regfi_key_free(REGFI_NK_REC* nk);
483	void regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
484	uint32 regfi_read(int fd, uint8* buf, uint32* length);
485
486	const char* regfi_type_val2str(unsigned int val);
487	int regfi_type_str2val(const char* str);
488
489	char* regfi_get_sacl(WINSEC_DESC* sec_desc);
490	char* regfi_get_dacl(WINSEC_DESC* sec_desc);
491	char* regfi_get_owner(WINSEC_DESC* sec_desc);
492	char* regfi_get_group(WINSEC_DESC* sec_desc);
493
494	REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists,
495	REGFI_SUBKEY_LIST** lists,
496	bool strict);
497	REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
498	uint32 max_size, bool strict,
499	uint8 depth_left);
500	void regfi_add_message(REGFI_FILE* file, uint16 msg_type,
501	const char* fmt, ...);
502	#endif /* _REGFI_H */

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: releases/0.10.0/include/regfi.h @ 273

Download in other formats: