source: releases/0.11.0/src/reglookup.c@ 293

Last change on this file since 293 was 150, checked in by tim, 16 years ago

integrated talloc into most of the rest of the regfi library
fixed a length validation issue
  • Property svn:keywords set to Id
File size: 17.1 KB
Line 
1/*
2 * A utility to read a Windows NT and later registry files.
3 *
4 * Copyright (C) 2005-2009 Timothy D. Morgan
5 * Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; version 3 of the License.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 *
20 * $Id: reglookup.c 150 2009-03-02 02:17:46Z tim $
21 */
22
23
24#include <stdlib.h>
25#include <stdio.h>
26#include <string.h>
27#include <strings.h>
28#include <time.h>
29#include "regfi.h"
30#include "void_stack.h"
31
32/* Globals, influenced by command line parameters */
33bool print_verbose = false;
34bool print_security = false;
35bool print_header = true;
36bool path_filter_enabled = false;
37bool type_filter_enabled = false;
38char* path_filter = NULL;
39int type_filter;
40char* registry_file = NULL;
41
42/* Other globals */
43REGFI_FILE* f;
44
45
46/* XXX: A hack to share some functions with reglookup-recover.c.
47 * Should move these into a proper library at some point.
48 */
49#include "common.c"
50
51
52void printValue(const REGFI_VK_REC* vk, char* prefix)
53{
54 char* quoted_value = NULL;
55 char* quoted_name = NULL;
56 char* conv_error = NULL;
57 const char* str_type = NULL;
58 uint32 size = vk->data_size;
59
60 /* Microsoft's documentation indicates that "available memory" is
61 * the limit on value sizes. Annoying. We limit it to 1M which
62 * should rarely be exceeded, unless the file is corrupt or
63 * malicious. For more info, see:
64 * http://msdn2.microsoft.com/en-us/library/ms724872.aspx
65 */
66 if(size > REGFI_VK_MAX_DATA_LENGTH)
67 {
68 fprintf(stderr, "WARN: value data size %d larger than "
69 "%d, truncating...\n", size, REGFI_VK_MAX_DATA_LENGTH);
70 size = REGFI_VK_MAX_DATA_LENGTH;
71 }
72
73 quoted_name = quote_string(vk->valuename, key_special_chars);
74 if (quoted_name == NULL)
75 { /* Value names are NULL when we're looking at the "(default)" value.
76 * Currently we just return a 0-length string to try an eliminate
77 * ambiguity with a literal "(default)" value. The data type of a line
78 * in the output allows one to differentiate between the parent key and
79 * this value.
80 */
81 quoted_name = malloc(1*sizeof(char));
82 if(quoted_name == NULL)
83 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Could not allocate sufficient memory.\n");
84 quoted_name[0] = '\0';
85 }
86
87 if(vk->data == NULL)
88 {
89 if(print_verbose)
90 fprintf(stderr, "INFO: While quoting value for '%s/%s', "
91 "data pointer was NULL.\n", prefix, quoted_name);
92 }
93 else
94 {
95 quoted_value = data_to_ascii(vk->data, size, vk->type, &conv_error);
96 if(quoted_value == NULL)
97 {
98 if(conv_error == NULL)
99 fprintf(stderr, "WARN: Could not quote value for '%s/%s'. "
100 "Memory allocation failure likely.\n", prefix, quoted_name);
101 else
102 fprintf(stderr, "WARN: Could not quote value for '%s/%s'. "
103 "Returned error: %s\n", prefix, quoted_name, conv_error);
104 }
105 else if(conv_error != NULL && print_verbose)
106 fprintf(stderr, "INFO: While quoting value for '%s/%s', "
107 "warning returned: %s\n", prefix, quoted_name, conv_error);
108 }
109
110 str_type = regfi_type_val2str(vk->type);
111 if(print_security)
112 {
113 if(str_type == NULL)
114 printf("%s/%s,0x%.8X,%s,,,,,\n", prefix, quoted_name,
115 vk->type, quoted_value);
116 else
117 printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
118 str_type, quoted_value);
119 }
120 else
121 {
122 if(str_type == NULL)
123 printf("%s/%s,0x%.8X,%s,\n", prefix, quoted_name,
124 vk->type, quoted_value);
125 else
126 printf("%s/%s,%s,%s,\n", prefix, quoted_name,
127 str_type, quoted_value);
128 }
129
130 if(quoted_value != NULL)
131 free(quoted_value);
132 if(quoted_name != NULL)
133 free(quoted_name);
134 if(conv_error != NULL)
135 free(conv_error);
136}
137
138
139char** splitPath(const char* s)
140{
141 char** ret_val;
142 const char* cur = s;
143 char* next = NULL;
144 char* copy;
145 uint32 ret_cur = 0;
146
147 ret_val = (char**)malloc((REGFI_MAX_DEPTH+1+1)*sizeof(char**));
148 if (ret_val == NULL)
149 return NULL;
150 ret_val[0] = NULL;
151
152 /* We return a well-formed, 0-length, path even when input is icky. */
153 if (s == NULL)
154 return ret_val;
155
156 while((next = strchr(cur, '/')) != NULL)
157 {
158 if ((next-cur) > 0)
159 {
160 copy = (char*)malloc((next-cur+1)*sizeof(char));
161 if(copy == NULL)
162 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
163
164 memcpy(copy, cur, next-cur);
165 copy[next-cur] = '\0';
166 ret_val[ret_cur++] = copy;
167 if(ret_cur < (REGFI_MAX_DEPTH+1+1))
168 ret_val[ret_cur] = NULL;
169 else
170 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Registry maximum depth exceeded.\n");
171 }
172 cur = next+1;
173 }
174
175 /* Grab last element, if path doesn't end in '/'. */
176 if(strlen(cur) > 0)
177 {
178 copy = strdup(cur);
179 ret_val[ret_cur++] = copy;
180 if(ret_cur < (REGFI_MAX_DEPTH+1+1))
181 ret_val[ret_cur] = NULL;
182 else
183 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Registry maximum depth exceeded.\n");
184 }
185
186 return ret_val;
187}
188
189
190void freePath(char** path)
191{
192 uint32 i;
193
194 if(path == NULL)
195 return;
196
197 for(i=0; path[i] != NULL; i++)
198 free(path[i]);
199
200 free(path);
201}
202
203
204/* Returns a quoted path from an iterator's stack */
205char* iter2Path(REGFI_ITERATOR* i)
206{
207 const REGFI_ITER_POSITION* cur;
208 uint32 buf_left = 127;
209 uint32 buf_len = buf_left+1;
210 uint32 name_len = 0;
211 uint32 grow_amt;
212 char* buf;
213 char* new_buf;
214 char* name;
215 const char* cur_name;
216 void_stack_iterator* iter;
217
218 buf = (char*)malloc((buf_len)*sizeof(char));
219 if (buf == NULL)
220 return NULL;
221 buf[0] = '\0';
222
223 iter = void_stack_iterator_new(i->key_positions);
224 if (iter == NULL)
225 {
226 free(buf);
227 return NULL;
228 }
229
230 /* skip root element */
231 if(void_stack_size(i->key_positions) < 1)
232 {
233 buf[0] = '/';
234 buf[1] = '\0';
235 return buf;
236 }
237 cur = void_stack_iterator_next(iter);
238
239 do
240 {
241 cur = void_stack_iterator_next(iter);
242 if (cur == NULL)
243 cur_name = i->cur_key->keyname;
244 else
245 cur_name = cur->nk->keyname;
246
247 buf[buf_len-buf_left-1] = '/';
248 buf_left -= 1;
249 name = quote_string(cur_name, key_special_chars);
250 name_len = strlen(name);
251 if(name_len+1 > buf_left)
252 {
253 grow_amt = (uint32)(buf_len/2);
254 buf_len += name_len+1+grow_amt-buf_left;
255 if((new_buf = realloc(buf, buf_len)) == NULL)
256 {
257 free(name);
258 free(buf);
259 free(iter);
260 return NULL;
261 }
262 buf = new_buf;
263 buf_left = grow_amt + name_len + 1;
264 }
265 strncpy(buf+(buf_len-buf_left-1), name, name_len);
266 buf_left -= name_len;
267 buf[buf_len-buf_left-1] = '\0';
268 free(name);
269 } while(cur != NULL);
270
271 return buf;
272}
273
274
275void printValueList(REGFI_ITERATOR* iter, char* prefix)
276{
277 REGFI_VK_REC* value;
278
279 value = regfi_iterator_first_value(iter);
280 while(value != NULL)
281 {
282 if(!type_filter_enabled || (value->type == type_filter))
283 printValue(value, prefix);
284 regfi_free_value(value);
285 value = regfi_iterator_next_value(iter);
286 printMsgs(iter->f);
287 }
288}
289
290
291void printKey(REGFI_ITERATOR* iter, char* full_path)
292{
293 static char empty_str[1] = "";
294 char* owner = NULL;
295 char* group = NULL;
296 char* sacl = NULL;
297 char* dacl = NULL;
298 char* quoted_classname;
299 char* error_msg = NULL;
300 char mtime[20];
301 time_t tmp_time[1];
302 struct tm* tmp_time_s = NULL;
303 const REGFI_SK_REC* sk;
304 const REGFI_NK_REC* k = regfi_iterator_cur_key(iter);
305
306 *tmp_time = nt_time_to_unix(&k->mtime);
307 tmp_time_s = gmtime(tmp_time);
308 strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
309
310 if(print_security && (sk=regfi_iterator_cur_sk(iter)))
311 {
312 owner = regfi_get_owner(sk->sec_desc);
313 group = regfi_get_group(sk->sec_desc);
314 sacl = regfi_get_sacl(sk->sec_desc);
315 dacl = regfi_get_dacl(sk->sec_desc);
316 if(owner == NULL)
317 owner = empty_str;
318 if(group == NULL)
319 group = empty_str;
320 if(sacl == NULL)
321 sacl = empty_str;
322 if(dacl == NULL)
323 dacl = empty_str;
324
325 if(k->classname != NULL)
326 {
327 quoted_classname = quote_unicode((uint8*)k->classname, k->classname_length,
328 key_special_chars, &error_msg);
329 if(quoted_classname == NULL)
330 {
331 if(error_msg == NULL)
332 fprintf(stderr, "ERROR: Could not quote classname"
333 " for key '%s' due to unknown error.\n", full_path);
334 else
335 {
336 fprintf(stderr, "ERROR: Could not quote classname"
337 " for key '%s' due to error: %s\n", full_path, error_msg);
338 free(error_msg);
339 }
340 }
341 else if (error_msg != NULL)
342 {
343 if(print_verbose)
344 fprintf(stderr, "INFO: While converting classname"
345 " for key '%s': %s.\n", full_path, error_msg);
346 free(error_msg);
347 }
348 }
349 else
350 quoted_classname = empty_str;
351
352 printMsgs(iter->f);
353 printf("%s,KEY,,%s,%s,%s,%s,%s,%s\n", full_path, mtime,
354 owner, group, sacl, dacl, quoted_classname);
355
356 if(owner != empty_str)
357 free(owner);
358 if(group != empty_str)
359 free(group);
360 if(sacl != empty_str)
361 free(sacl);
362 if(dacl != empty_str)
363 free(dacl);
364 if(quoted_classname != empty_str)
365 free(quoted_classname);
366 }
367 else
368 printf("%s,KEY,,%s\n", full_path, mtime);
369}
370
371
372void printKeyTree(REGFI_ITERATOR* iter)
373{
374 const REGFI_NK_REC* root = NULL;
375 const REGFI_NK_REC* cur = NULL;
376 REGFI_NK_REC* sub = NULL;
377 char* path = NULL;
378 int key_type = regfi_type_str2val("KEY");
379 bool print_this = true;
380
381 root = cur = regfi_iterator_cur_key(iter);
382 sub = regfi_iterator_first_subkey(iter);
383 printMsgs(iter->f);
384
385 if(root == NULL)
386 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: root cannot be NULL.\n");
387
388 do
389 {
390 if(print_this)
391 {
392 path = iter2Path(iter);
393 if(path == NULL)
394 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Could not construct iterator's path.\n");
395
396 if(!type_filter_enabled || (key_type == type_filter))
397 printKey(iter, path);
398 if(!type_filter_enabled || (key_type != type_filter))
399 printValueList(iter, path);
400
401 free(path);
402 }
403
404 if(sub == NULL)
405 {
406 if(cur != root)
407 {
408 /* We're done with this sub-tree, going up and hitting other branches. */
409 if(!regfi_iterator_up(iter))
410 {
411 printMsgs(iter->f);
412 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: could not traverse iterator upward.\n");
413 }
414
415 cur = regfi_iterator_cur_key(iter);
416 if(cur == NULL)
417 {
418 printMsgs(iter->f);
419 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: unexpected NULL for key.\n");
420 }
421
422 sub = regfi_iterator_next_subkey(iter);
423 }
424 print_this = false;
425 }
426 else
427 { /* We have unexplored sub-keys.
428 * Let's move down and print this first sub-tree out.
429 */
430 if(!regfi_iterator_down(iter))
431 {
432 printMsgs(iter->f);
433 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: could not traverse iterator downward.\n");
434 }
435
436 cur = regfi_iterator_cur_key(iter);
437 regfi_free_key(sub);
438 sub = regfi_iterator_first_subkey(iter);
439 print_this = true;
440 }
441 printMsgs(iter->f);
442 } while(!((cur == root) && (sub == NULL)));
443
444 if(print_verbose)
445 fprintf(stderr, "INFO: Finished printing key tree.\n");
446}
447
448
449/* XXX: What if there is BOTH a value AND a key with that name??
450 * What if there are multiple keys/values with the same name??
451 */
452/*
453 * Returns 0 if path was not found.
454 * Returns 1 if path was found as value.
455 * Returns 2 if path was found as key.
456 * Returns less than 0 on other error.
457 */
458int retrievePath(REGFI_ITERATOR* iter, char** path)
459{
460 REGFI_VK_REC* value;
461 char* tmp_path_joined;
462 const char** tmp_path;
463 uint32 i;
464
465 if(path == NULL)
466 return -1;
467
468 /* One extra for any value at the end, and one more for NULL */
469 tmp_path = (const char**)malloc(sizeof(const char**)*(REGFI_MAX_DEPTH+1+1));
470 if(tmp_path == NULL)
471 return -2;
472
473 /* Strip any potential value name at end of path */
474 for(i=0;
475 (path[i] != NULL) && (path[i+1] != NULL) && (i < REGFI_MAX_DEPTH+1);
476 i++)
477 { tmp_path[i] = path[i]; }
478 tmp_path[i] = NULL;
479
480 if(print_verbose)
481 fprintf(stderr, "INFO: Attempting to retrieve specified path: %s\n",
482 path_filter);
483
484 /* Special check for '/' path filter */
485 if(path[0] == NULL)
486 {
487 if(print_verbose)
488 fprintf(stderr, "INFO: Found final path element as root key.\n");
489 free(tmp_path);
490 return 2;
491 }
492
493 if(!regfi_iterator_walk_path(iter, tmp_path))
494 {
495 printMsgs(iter->f);
496 free(tmp_path);
497 return 0;
498 }
499
500 if(regfi_iterator_find_value(iter, path[i]))
501 {
502 if(print_verbose)
503 fprintf(stderr, "INFO: Found final path element as value.\n");
504
505 value = regfi_iterator_cur_value(iter);
506 printMsgs(iter->f);
507 tmp_path_joined = iter2Path(iter);
508
509 if((value == NULL) || (tmp_path_joined == NULL))
510 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Unexpected error before printValue.\n");
511
512 if(!type_filter_enabled || (value->type == type_filter))
513 printValue(value, tmp_path_joined);
514
515 regfi_free_value(value);
516 free(tmp_path);
517 free(tmp_path_joined);
518 return 1;
519 }
520 else if(regfi_iterator_find_subkey(iter, path[i]))
521 {
522 printMsgs(iter->f);
523 if(print_verbose)
524 fprintf(stderr, "INFO: Found final path element as key.\n");
525
526 if(!regfi_iterator_down(iter))
527 {
528 printMsgs(iter->f);
529 bailOut(REGLOOKUP_EXIT_DATAERR, "ERROR: Unexpected error on traversing path filter key.\n");
530 }
531
532 return 2;
533 }
534 printMsgs(iter->f);
535
536 if(print_verbose)
537 fprintf(stderr, "INFO: Could not find last element of path.\n");
538
539 return 0;
540}
541
542
543static void usage(void)
544{
545 fprintf(stderr, "Usage: reglookup [-v] [-s]"
546 " [-p <PATH_FILTER>] [-t <TYPE_FILTER>]"
547 " <REGISTRY_FILE>\n");
548 fprintf(stderr, "Version: %s\n", REGLOOKUP_VERSION);
549 fprintf(stderr, "Options:\n");
550 fprintf(stderr, "\t-v\t sets verbose mode.\n");
551 fprintf(stderr, "\t-h\t enables header row. (default)\n");
552 fprintf(stderr, "\t-H\t disables header row.\n");
553 fprintf(stderr, "\t-s\t enables security descriptor output.\n");
554 fprintf(stderr, "\t-S\t disables security descriptor output. (default)\n");
555 fprintf(stderr, "\t-p\t restrict output to elements below this path.\n");
556 fprintf(stderr, "\t-t\t restrict results to this specific data type.\n");
557 fprintf(stderr, "\n");
558}
559
560
561int main(int argc, char** argv)
562{
563 char** path = NULL;
564 REGFI_ITERATOR* iter;
565 int retr_path_ret;
566 uint32 argi, arge;
567
568 /* Process command line arguments */
569 if(argc < 2)
570 {
571 usage();
572 bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: Requires at least one argument.\n");
573 }
574
575 arge = argc-1;
576 for(argi = 1; argi < arge; argi++)
577 {
578 if (strcmp("-p", argv[argi]) == 0)
579 {
580 if(++argi >= arge)
581 {
582 usage();
583 bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: '-p' option requires parameter.\n");
584 }
585 if((path_filter = strdup(argv[argi])) == NULL)
586 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
587
588 path_filter_enabled = true;
589 }
590 else if (strcmp("-t", argv[argi]) == 0)
591 {
592 if(++argi >= arge)
593 {
594 usage();
595 bailOut(REGLOOKUP_EXIT_USAGE, "ERROR: '-t' option requires parameter.\n");
596 }
597 if((type_filter = regfi_type_str2val(argv[argi])) < 0)
598 {
599 fprintf(stderr, "ERROR: Invalid type specified: %s.\n", argv[argi]);
600 bailOut(REGLOOKUP_EXIT_USAGE, "");
601 }
602 type_filter_enabled = true;
603 }
604 else if (strcmp("-h", argv[argi]) == 0)
605 print_header = true;
606 else if (strcmp("-H", argv[argi]) == 0)
607 print_header = false;
608 else if (strcmp("-s", argv[argi]) == 0)
609 print_security = true;
610 else if (strcmp("-S", argv[argi]) == 0)
611 print_security = false;
612 else if (strcmp("-v", argv[argi]) == 0)
613 print_verbose = true;
614 else
615 {
616 usage();
617 fprintf(stderr, "ERROR: Unrecognized option: %s\n", argv[argi]);
618 bailOut(REGLOOKUP_EXIT_USAGE, "");
619 }
620 }
621 if((registry_file = strdup(argv[argi])) == NULL)
622 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Memory allocation problem.\n");
623
624 f = regfi_open(registry_file);
625 if(f == NULL)
626 {
627 fprintf(stderr, "ERROR: Couldn't open registry file: %s\n", registry_file);
628 bailOut(REGLOOKUP_EXIT_NOINPUT, "");
629 }
630
631 if(print_verbose)
632 regfi_set_message_mask(f, REGFI_MSG_INFO|REGFI_MSG_WARN|REGFI_MSG_ERROR);
633
634 iter = regfi_iterator_new(f);
635 if(iter == NULL)
636 bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Couldn't create registry iterator.\n");
637
638 if(print_header)
639 {
640 if(print_security)
641 printf("PATH,TYPE,VALUE,MTIME,OWNER,GROUP,SACL,DACL,CLASS\n");
642 else
643 printf("PATH,TYPE,VALUE,MTIME\n");
644 }
645
646 if(path_filter_enabled && path_filter != NULL)
647 path = splitPath(path_filter);
648
649 if(path != NULL)
650 {
651 retr_path_ret = retrievePath(iter, path);
652 printMsgs(iter->f);
653 freePath(path);
654
655 if(retr_path_ret == 0)
656 fprintf(stderr, "WARN: Specified path '%s' not found.\n", path_filter);
657 else if (retr_path_ret == 2)
658 printKeyTree(iter);
659 else if(retr_path_ret < 0)
660 {
661 fprintf(stderr, "ERROR: retrievePath() returned %d.\n",
662 retr_path_ret);
663 bailOut(REGLOOKUP_EXIT_DATAERR,
664 "ERROR: Unknown error occurred in retrieving path.\n");
665 }
666 }
667 else
668 printKeyTree(iter);
669
670 regfi_iterator_free(iter);
671 regfi_close(f);
672
673 return 0;
674}
Note: See TracBrowser for help on using the repository browser.