source: releases/0.11.0/src/reglookup.c @ 189

Last change on this file since 189 was 150, checked in by tim, 16 years ago

integrated talloc into most of the rest of the regfi library
fixed a length validation issue

  • Property svn:keywords set to Id
File size: 17.1 KB
Line 
1/*
2 * A utility to read a Windows NT and later registry files.
3 *
4 * Copyright (C) 2005-2009 Timothy D. Morgan
5 * Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; version 3 of the License.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 
19 *
20 * $Id: reglookup.c 150 2009-03-02 02:17:46Z tim $
21 */
22
23
24#include <stdlib.h>
25#include <stdio.h>
26#include <string.h>
27#include <strings.h>
28#include <time.h>
29#include "regfi.h"
30#include "void_stack.h"
31
32/* Globals, influenced by command line parameters */
33bool print_verbose = false;
34bool print_security = false;
35bool print_header = true;
36bool path_filter_enabled = false;
37bool type_filter_enabled = false;
38char* path_filter = NULL;
39int type_filter;
40char* registry_file = NULL;
41
42/* Other globals */
43REGFI_FILE* f;
44
45
46/* XXX: A hack to share some functions with reglookup-recover.c.
47 *      Should move these into a proper library at some point.
48 */
49#include "common.c"
50
51
52void printValue(const REGFI_VK_REC* vk, char* prefix)
53{
54  char* quoted_value = NULL;
55  char* quoted_name = NULL;
56  char* conv_error = NULL;
57  const char* str_type = NULL;
58  uint32 size = vk->data_size;
59
60  /* Microsoft's documentation indicates that "available memory" is
61   * the limit on value sizes.  Annoying.  We limit it to 1M which
62   * should rarely be exceeded, unless the file is corrupt or
63   * malicious. For more info, see:
64   *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
65   */
66  if(size > REGFI_VK_MAX_DATA_LENGTH)
67  {
68    fprintf(stderr, "WARN: value data size %d larger than "
69            "%d, truncating...\n", size, REGFI_VK_MAX_DATA_LENGTH);
70    size = REGFI_VK_MAX_DATA_LENGTH;
71  }
72 
73  quoted_name = quote_string(vk->valuename, key_special_chars);
74  if (quoted_name == NULL)
75  { /* Value names are NULL when we're looking at the "(default)" value.
76     * Currently we just return a 0-length string to try an eliminate
77     * ambiguity with a literal "(default)" value.  The data type of a line
78     * in the output allows one to differentiate between the parent key and
79     * this value.
80     */
81    quoted_name = malloc(1*sizeof(char));
82    if(quoted_name == NULL)
83      bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Could not allocate sufficient memory.\n");
84    quoted_name[0] = '\0';
85  }
86
87  if(vk->data == NULL)
88  {
89    if(print_verbose)
90      fprintf(stderr, "INFO: While quoting value for '%s/%s', "
91              "data pointer was NULL.\n", prefix, quoted_name);
92  }
93  else
94  {
95    quoted_value = data_to_ascii(vk->data, size, vk->type, &conv_error);
96    if(quoted_value == NULL)
97    {
98      if(conv_error == NULL)
99        fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
100                "Memory allocation failure likely.\n", prefix, quoted_name);
101      else
102        fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
103                "Returned error: %s\n", prefix, quoted_name, conv_error);
104    }
105    else if(conv_error != NULL && print_verbose)
106      fprintf(stderr, "INFO: While quoting value for '%s/%s', "
107              "warning returned: %s\n", prefix, quoted_name, conv_error);
108  }
109
110  str_type = regfi_type_val2str(vk->type);
111  if(print_security)
112  {
113    if(str_type == NULL)
114      printf("%s/%s,0x%.8X,%s,,,,,\n", prefix, quoted_name,
115             vk->type, quoted_value);
116    else
117      printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
118             str_type, quoted_value);
119  }
120  else
121  {
122    if(str_type == NULL)
123      printf("%s/%s,0x%.8X,%s,\n", prefix, quoted_name,
124             vk->type, quoted_value);
125    else
126      printf("%s/%s,%s,%s,\n", prefix, quoted_name,
127             str_type, quoted_value);
128  }
129
130  if(quoted_value != NULL)
131    free(quoted_value);
132  if(quoted_name != NULL)
133    free(quoted_name);
134  if(conv_error != NULL)
135    free(conv_error);
136}
137
138
139char** splitPath(const char* s)
140{
141  char** ret_val;
142  const char* cur = s;
143  char* next = NULL;
144  char* copy;
145  uint32 ret_cur = 0;
146
147  ret_val = (char**)malloc((REGFI_MAX_DEPTH+1+1)*sizeof(char**));
148  if (ret_val == NULL)
149    return NULL;
150  ret_val[0] = NULL;
151
152  /* We return a well-formed, 0-length, path even when input is icky. */
153  if (s == NULL)
154    return ret_val;
155 
156  while((next = strchr(cur, '/')) != NULL)
157  {
158    if ((next-cur) > 0)
159    {
160      copy = (char*)malloc((next-cur+1)*sizeof(char));
161      if(copy == NULL)
162        bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
163         
164      memcpy(copy, cur, next-cur);
165      copy[next-cur] = '\0';
166      ret_val[ret_cur++] = copy;
167      if(ret_cur < (REGFI_MAX_DEPTH+1+1))
168        ret_val[ret_cur] = NULL;
169      else
170        bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Registry maximum depth exceeded.\n");
171    }
172    cur = next+1;
173  }
174
175  /* Grab last element, if path doesn't end in '/'. */
176  if(strlen(cur) > 0)
177  {
178    copy = strdup(cur);
179    ret_val[ret_cur++] = copy;
180    if(ret_cur < (REGFI_MAX_DEPTH+1+1))
181      ret_val[ret_cur] = NULL;
182    else
183      bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Registry maximum depth exceeded.\n");
184  }
185
186  return ret_val;
187}
188
189
190void freePath(char** path)
191{
192  uint32 i;
193
194  if(path == NULL)
195    return;
196
197  for(i=0; path[i] != NULL; i++)
198    free(path[i]);
199
200  free(path);
201}
202
203
204/* Returns a quoted path from an iterator's stack */
205char* iter2Path(REGFI_ITERATOR* i)
206{
207  const REGFI_ITER_POSITION* cur;
208  uint32 buf_left = 127;
209  uint32 buf_len = buf_left+1;
210  uint32 name_len = 0;
211  uint32 grow_amt;
212  char* buf;
213  char* new_buf;
214  char* name;
215  const char* cur_name;
216  void_stack_iterator* iter;
217 
218  buf = (char*)malloc((buf_len)*sizeof(char));
219  if (buf == NULL)
220    return NULL;
221  buf[0] = '\0';
222
223  iter = void_stack_iterator_new(i->key_positions);
224  if (iter == NULL)
225  {
226    free(buf);
227    return NULL;
228  }
229
230  /* skip root element */
231  if(void_stack_size(i->key_positions) < 1)
232  {
233    buf[0] = '/';
234    buf[1] = '\0';
235    return buf;
236  }
237  cur = void_stack_iterator_next(iter);
238
239  do
240  {
241    cur = void_stack_iterator_next(iter);
242    if (cur == NULL)
243      cur_name = i->cur_key->keyname;
244    else
245      cur_name = cur->nk->keyname;
246
247    buf[buf_len-buf_left-1] = '/';
248    buf_left -= 1;
249    name = quote_string(cur_name, key_special_chars);
250    name_len = strlen(name);
251    if(name_len+1 > buf_left)
252    {
253      grow_amt = (uint32)(buf_len/2);
254      buf_len += name_len+1+grow_amt-buf_left;
255      if((new_buf = realloc(buf, buf_len)) == NULL)
256      {
257        free(name);
258        free(buf);
259        free(iter);
260        return NULL;
261      }
262      buf = new_buf;
263      buf_left = grow_amt + name_len + 1;
264    }
265    strncpy(buf+(buf_len-buf_left-1), name, name_len);
266    buf_left -= name_len;
267    buf[buf_len-buf_left-1] = '\0';
268    free(name);
269  } while(cur != NULL);
270
271  return buf;
272}
273
274
275void printValueList(REGFI_ITERATOR* iter, char* prefix)
276{
277  REGFI_VK_REC* value;
278
279  value = regfi_iterator_first_value(iter);
280  while(value != NULL)
281  {
282    if(!type_filter_enabled || (value->type == type_filter))
283      printValue(value, prefix);
284    regfi_free_value(value);
285    value = regfi_iterator_next_value(iter);
286    printMsgs(iter->f);
287  }
288}
289
290
291void printKey(REGFI_ITERATOR* iter, char* full_path)
292{
293  static char empty_str[1] = "";
294  char* owner = NULL;
295  char* group = NULL;
296  char* sacl = NULL;
297  char* dacl = NULL;
298  char* quoted_classname;
299  char* error_msg = NULL;
300  char mtime[20];
301  time_t tmp_time[1];
302  struct tm* tmp_time_s = NULL;
303  const REGFI_SK_REC* sk;
304  const REGFI_NK_REC* k = regfi_iterator_cur_key(iter);
305
306  *tmp_time = nt_time_to_unix(&k->mtime);
307  tmp_time_s = gmtime(tmp_time);
308  strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
309
310  if(print_security && (sk=regfi_iterator_cur_sk(iter)))
311  {
312    owner = regfi_get_owner(sk->sec_desc);
313    group = regfi_get_group(sk->sec_desc);
314    sacl = regfi_get_sacl(sk->sec_desc);
315    dacl = regfi_get_dacl(sk->sec_desc);
316    if(owner == NULL)
317      owner = empty_str;
318    if(group == NULL)
319      group = empty_str;
320    if(sacl == NULL)
321      sacl = empty_str;
322    if(dacl == NULL)
323      dacl = empty_str;
324
325    if(k->classname != NULL)
326    {
327      quoted_classname = quote_unicode((uint8*)k->classname, k->classname_length,
328                                       key_special_chars, &error_msg);
329      if(quoted_classname == NULL)
330      {
331        if(error_msg == NULL)
332          fprintf(stderr, "ERROR: Could not quote classname"
333                  " for key '%s' due to unknown error.\n", full_path);
334        else
335        {
336          fprintf(stderr, "ERROR: Could not quote classname"
337                  " for key '%s' due to error: %s\n", full_path, error_msg);
338          free(error_msg);
339        }
340      }
341      else if (error_msg != NULL)
342      {
343        if(print_verbose)
344          fprintf(stderr, "INFO: While converting classname"
345                  " for key '%s': %s.\n", full_path, error_msg);
346        free(error_msg);
347      }
348    }
349    else
350      quoted_classname = empty_str;
351
352    printMsgs(iter->f);
353    printf("%s,KEY,,%s,%s,%s,%s,%s,%s\n", full_path, mtime, 
354           owner, group, sacl, dacl, quoted_classname);
355
356    if(owner != empty_str)
357      free(owner);
358    if(group != empty_str)
359      free(group);
360    if(sacl != empty_str)
361      free(sacl);
362    if(dacl != empty_str)
363      free(dacl);
364    if(quoted_classname != empty_str)
365      free(quoted_classname);
366  }
367  else
368    printf("%s,KEY,,%s\n", full_path, mtime);
369}
370
371
372void printKeyTree(REGFI_ITERATOR* iter)
373{
374  const REGFI_NK_REC* root = NULL;
375  const REGFI_NK_REC* cur = NULL;
376  REGFI_NK_REC* sub = NULL;
377  char* path = NULL;
378  int key_type = regfi_type_str2val("KEY");
379  bool print_this = true;
380
381  root = cur = regfi_iterator_cur_key(iter);
382  sub = regfi_iterator_first_subkey(iter);
383  printMsgs(iter->f);
384
385  if(root == NULL)
386    bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: root cannot be NULL.\n");
387 
388  do
389  {
390    if(print_this)
391    {
392      path = iter2Path(iter);
393      if(path == NULL)
394        bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Could not construct iterator's path.\n");
395
396      if(!type_filter_enabled || (key_type == type_filter))
397        printKey(iter, path);
398      if(!type_filter_enabled || (key_type != type_filter))
399        printValueList(iter, path);
400     
401      free(path);
402    }
403   
404    if(sub == NULL)
405    {
406      if(cur != root)
407      {
408        /* We're done with this sub-tree, going up and hitting other branches. */
409        if(!regfi_iterator_up(iter))
410        {
411          printMsgs(iter->f);
412          bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: could not traverse iterator upward.\n");
413        }
414
415        cur = regfi_iterator_cur_key(iter);
416        if(cur == NULL)
417        {
418          printMsgs(iter->f);
419          bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: unexpected NULL for key.\n");
420        }
421       
422        sub = regfi_iterator_next_subkey(iter);
423      }
424      print_this = false;
425    }
426    else
427    { /* We have unexplored sub-keys. 
428       * Let's move down and print this first sub-tree out.
429       */
430      if(!regfi_iterator_down(iter))
431      {
432        printMsgs(iter->f);
433        bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: could not traverse iterator downward.\n");
434      }
435
436      cur = regfi_iterator_cur_key(iter);
437      regfi_free_key(sub);
438      sub = regfi_iterator_first_subkey(iter);
439      print_this = true;
440    }
441    printMsgs(iter->f);
442  } while(!((cur == root) && (sub == NULL)));
443
444  if(print_verbose)
445    fprintf(stderr, "INFO: Finished printing key tree.\n");
446}
447
448
449/* XXX: What if there is BOTH a value AND a key with that name??
450 *      What if there are multiple keys/values with the same name??
451 */
452/*
453 * Returns 0 if path was not found.
454 * Returns 1 if path was found as value.
455 * Returns 2 if path was found as key.
456 * Returns less than 0 on other error.
457 */
458int retrievePath(REGFI_ITERATOR* iter, char** path)
459{
460  REGFI_VK_REC* value;
461  char* tmp_path_joined;
462  const char** tmp_path;
463  uint32 i;
464 
465  if(path == NULL)
466    return -1;
467
468  /* One extra for any value at the end, and one more for NULL */
469  tmp_path = (const char**)malloc(sizeof(const char**)*(REGFI_MAX_DEPTH+1+1));
470  if(tmp_path == NULL)
471    return -2;
472
473  /* Strip any potential value name at end of path */
474  for(i=0; 
475      (path[i] != NULL) && (path[i+1] != NULL) && (i < REGFI_MAX_DEPTH+1);
476      i++)
477  { tmp_path[i] = path[i]; }
478  tmp_path[i] = NULL;
479
480  if(print_verbose)
481    fprintf(stderr, "INFO: Attempting to retrieve specified path: %s\n",
482            path_filter);
483
484  /* Special check for '/' path filter */
485  if(path[0] == NULL)
486  {
487    if(print_verbose)
488      fprintf(stderr, "INFO: Found final path element as root key.\n");
489    free(tmp_path);
490    return 2;
491  }
492
493  if(!regfi_iterator_walk_path(iter, tmp_path))
494  {
495    printMsgs(iter->f);
496    free(tmp_path);
497    return 0;
498  }
499
500  if(regfi_iterator_find_value(iter, path[i]))
501  {
502    if(print_verbose)
503      fprintf(stderr, "INFO: Found final path element as value.\n");
504
505    value = regfi_iterator_cur_value(iter);
506    printMsgs(iter->f);
507    tmp_path_joined = iter2Path(iter);
508
509    if((value == NULL) || (tmp_path_joined == NULL))
510      bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Unexpected error before printValue.\n");
511
512    if(!type_filter_enabled || (value->type == type_filter))
513      printValue(value, tmp_path_joined);
514
515    regfi_free_value(value);
516    free(tmp_path);
517    free(tmp_path_joined);
518    return 1;
519  }
520  else if(regfi_iterator_find_subkey(iter, path[i]))
521  {
522    printMsgs(iter->f);
523    if(print_verbose)
524      fprintf(stderr, "INFO: Found final path element as key.\n");
525
526    if(!regfi_iterator_down(iter))
527    {
528      printMsgs(iter->f);
529      bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Unexpected error on traversing path filter key.\n");
530    }
531
532    return 2;
533  }
534  printMsgs(iter->f);
535
536  if(print_verbose)
537    fprintf(stderr, "INFO: Could not find last element of path.\n");
538
539  return 0;
540}
541
542
543static void usage(void)
544{
545  fprintf(stderr, "Usage: reglookup [-v] [-s]"
546          " [-p <PATH_FILTER>] [-t <TYPE_FILTER>]"
547          " <REGISTRY_FILE>\n");
548  fprintf(stderr, "Version: %s\n", REGLOOKUP_VERSION);
549  fprintf(stderr, "Options:\n");
550  fprintf(stderr, "\t-v\t sets verbose mode.\n");
551  fprintf(stderr, "\t-h\t enables header row. (default)\n");
552  fprintf(stderr, "\t-H\t disables header row.\n");
553  fprintf(stderr, "\t-s\t enables security descriptor output.\n");
554  fprintf(stderr, "\t-S\t disables security descriptor output. (default)\n");
555  fprintf(stderr, "\t-p\t restrict output to elements below this path.\n");
556  fprintf(stderr, "\t-t\t restrict results to this specific data type.\n");
557  fprintf(stderr, "\n");
558}
559
560
561int main(int argc, char** argv)
562{
563  char** path = NULL;
564  REGFI_ITERATOR* iter;
565  int retr_path_ret;
566  uint32 argi, arge;
567
568  /* Process command line arguments */
569  if(argc < 2)
570  {
571    usage();
572    bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: Requires at least one argument.\n");
573  }
574 
575  arge = argc-1;
576  for(argi = 1; argi < arge; argi++)
577  {
578    if (strcmp("-p", argv[argi]) == 0)
579    {
580      if(++argi >= arge)
581      {
582        usage();
583        bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: '-p' option requires parameter.\n");
584      }
585      if((path_filter = strdup(argv[argi])) == NULL)
586        bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
587
588      path_filter_enabled = true;
589    }
590    else if (strcmp("-t", argv[argi]) == 0)
591    {
592      if(++argi >= arge)
593      {
594        usage();
595        bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: '-t' option requires parameter.\n");
596      }
597      if((type_filter = regfi_type_str2val(argv[argi])) < 0)
598      {
599        fprintf(stderr, "ERROR: Invalid type specified: %s.\n", argv[argi]);
600        bailOut(REGLOOKUP_EXIT_USAGE, "");
601      }
602      type_filter_enabled = true;
603    }
604    else if (strcmp("-h", argv[argi]) == 0)
605      print_header = true;
606    else if (strcmp("-H", argv[argi]) == 0)
607      print_header = false;
608    else if (strcmp("-s", argv[argi]) == 0)
609      print_security = true;
610    else if (strcmp("-S", argv[argi]) == 0)
611      print_security = false;
612    else if (strcmp("-v", argv[argi]) == 0)
613      print_verbose = true;
614    else
615    {
616      usage();
617      fprintf(stderr, "ERROR: Unrecognized option: %s\n", argv[argi]);
618      bailOut(REGLOOKUP_EXIT_USAGE, "");
619    }
620  }
621  if((registry_file = strdup(argv[argi])) == NULL)
622    bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
623
624  f = regfi_open(registry_file);
625  if(f == NULL)
626  {
627    fprintf(stderr, "ERROR: Couldn't open registry file: %s\n", registry_file);
628    bailOut(REGLOOKUP_EXIT_NOINPUT, "");
629  }
630
631  if(print_verbose)
632    regfi_set_message_mask(f, REGFI_MSG_INFO|REGFI_MSG_WARN|REGFI_MSG_ERROR);
633
634  iter = regfi_iterator_new(f);
635  if(iter == NULL)
636    bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Couldn't create registry iterator.\n");
637
638  if(print_header)
639  {
640    if(print_security)
641      printf("PATH,TYPE,VALUE,MTIME,OWNER,GROUP,SACL,DACL,CLASS\n");
642    else
643      printf("PATH,TYPE,VALUE,MTIME\n");
644  }
645
646  if(path_filter_enabled && path_filter != NULL)
647    path = splitPath(path_filter);
648
649  if(path != NULL)
650  {
651    retr_path_ret = retrievePath(iter, path);
652    printMsgs(iter->f);
653    freePath(path);
654
655    if(retr_path_ret == 0)
656      fprintf(stderr, "WARN: Specified path '%s' not found.\n", path_filter);
657    else if (retr_path_ret == 2)
658      printKeyTree(iter);
659    else if(retr_path_ret < 0)
660    {
661      fprintf(stderr, "ERROR: retrievePath() returned %d.\n", 
662              retr_path_ret);
663      bailOut(REGLOOKUP_EXIT_DATAERR,
664              "ERROR: Unknown error occurred in retrieving path.\n");
665    }
666  }
667  else
668    printKeyTree(iter);
669
670  regfi_iterator_free(iter);
671  regfi_close(f);
672
673  return 0;
674}
Note: See TracBrowser for help on using the repository browser.