source: releases/0.9.0/include/regfi.h@ 209

Last change on this file since 209 was 121, checked in by tim, 17 years ago

fixed minor path/type filter bug in reglookup
misc code cleanups
  • Property svn:keywords set to Id
File size: 12.1 KB
Line 
1/*
2 * Branched from Samba project, Subversion repository version #6903:
3 * http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Unix SMB/CIFS implementation.
6 * Windows NT registry I/O library
7 *
8 * Copyright (C) 2005-2008 Timothy D. Morgan
9 * Copyright (C) 2005 Gerald (Jerry) Carter
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; version 2 of the License.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 *
24 * $Id: regfi.h 121 2008-08-09 17:22:26Z tim $
25 */
26
27/************************************************************
28 * Most of this information was obtained from
29 * http://www.wednesday.demon.co.uk/dosreg.html
30 * Thanks Nigel!
31 ***********************************************************/
32
33#ifndef _REGFI_H
34#define _REGFI_H
35
36#include <stdlib.h>
37#include <stdio.h>
38#include <stdbool.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "void_stack.h"
50#include "range_list.h"
51#include "lru_cache.h"
52
53/******************************************************************************/
54/* Macros */
55
56/* Registry data types */
57#define REG_NONE 0
58#define REG_SZ 1
59#define REG_EXPAND_SZ 2
60#define REG_BINARY 3
61#define REG_DWORD 4
62#define REG_DWORD_LE 4 /* DWORD, little endian */
63#define REG_DWORD_BE 5 /* DWORD, big endian */
64#define REG_LINK 6
65#define REG_MULTI_SZ 7
66#define REG_RESOURCE_LIST 8
67#define REG_FULL_RESOURCE_DESCRIPTOR 9
68#define REG_RESOURCE_REQUIREMENTS_LIST 10
69#define REG_QWORD 11 /* 64-bit little endian */
70/* XXX: Has MS defined a REG_QWORD_BE? */
71/* Not a real type in the registry */
72#define REG_KEY 0x7FFFFFFF
73
74#define REGF_BLOCKSIZE 0x1000
75#define REGF_ALLOC_BLOCK 0x1000 /* Minimum allocation unit for HBINs */
76#define REGF_MAX_DEPTH 512
77
78/* header sizes for various records */
79#define REGF_MAGIC_SIZE 4
80#define HBIN_MAGIC_SIZE 4
81#define HBIN_HEADER_REC_SIZE 0x20
82#define REC_HDR_SIZE 2
83
84#define REGF_OFFSET_NONE 0xffffffff
85#define REGFI_NK_MIN_LENGTH 0x4C
86#define REGFI_VK_MIN_LENGTH 0x14
87#define REGFI_SK_MIN_LENGTH 0x14
88#define REGFI_HASH_LIST_MIN_LENGTH 0x4
89
90/* Constants used for validation */
91 /* Minimum time is Jan 1, 1990 00:00:00 */
92#define REGFI_MTIME_MIN_HIGH 0x01B41E6D
93#define REGFI_MTIME_MIN_LOW 0x26F98000
94 /* Maximum time is Jan 1, 2290 00:00:00
95 * (We hope no one is using Windows by then...)
96 */
97#define REGFI_MTIME_MAX_HIGH 0x03047543
98#define REGFI_MTIME_MAX_LOW 0xC80A4000
99
100
101/* Flags for the vk records */
102#define VK_FLAG_NAME_PRESENT 0x0001
103#define VK_DATA_IN_OFFSET 0x80000000
104#define VK_MAX_DATA_LENGTH 1024*1024
105
106/* NK record types */
107#define NK_TYPE_LINKKEY 0x0010
108#define NK_TYPE_NORMALKEY 0x0020
109#define NK_TYPE_ROOTKEY 0x002c
110 /* TODO: Unknown type that shows up in Vista registries */
111#define NK_TYPE_UNKNOWN1 0x1020
112
113
114/* HBIN block */
115typedef struct regf_hbin
116{
117 uint32 file_off; /* my offset in the registry file */
118 uint32 ref_count; /* how many active records are pointing to this
119 * block (not used currently)
120 */
121
122 uint32 first_hbin_off; /* offset from first hbin block */
123 uint32 block_size; /* block size of this block
124 * Should be a multiple of 4096 (0x1000)
125 */
126 uint32 next_block; /* relative offset to next block.
127 * NOTE: This value may be unreliable!
128 */
129
130 uint8 magic[HBIN_MAGIC_SIZE]; /* "hbin" */
131} REGF_HBIN;
132
133
134/* Hash List -- list of key offsets and hashed names for consistency */
135typedef struct
136{
137 uint32 nk_off;
138 uint32 hash;
139} REGF_HASH_LIST_ELEM;
140
141
142typedef struct
143{
144 uint32 offset; /* Real offset of this record's cell in the file */
145 uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
146 REGF_HBIN* hbin; /* pointer to HBIN record (in memory) containing
147 * this nk record
148 */
149 uint32 hbin_off; /* offset from beginning of this hbin block */
150 REGF_HASH_LIST_ELEM* hashes;
151
152 uint8 magic[REC_HDR_SIZE];
153 uint16 num_keys;
154} REGF_HASH_LIST;
155
156
157/* Key Value */
158typedef struct
159{
160 uint32 offset; /* Real offset of this record's cell in the file */
161 uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
162
163 REGF_HBIN* hbin; /* pointer to HBIN record (in memory) containing
164 * this nk record
165 */
166 uint8* data;
167 uint16 name_length;
168 char* valuename;
169 uint32 hbin_off; /* offset from beginning of this hbin block */
170
171 uint32 data_size;
172 uint32 data_off; /* offset of data cell (virtual) */
173 uint32 type;
174 uint8 magic[REC_HDR_SIZE];
175 uint16 flag;
176 uint16 unknown1;
177 bool data_in_offset;
178} REGF_VK_REC;
179
180
181/* Key Security */
182struct _regf_sk_rec;
183
184typedef struct _regf_sk_rec
185{
186 uint32 offset; /* Real file offset of this record */
187 uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
188
189 SEC_DESC* sec_desc;
190 uint32 hbin_off; /* offset from beginning of this hbin block */
191
192 uint32 sk_off; /* offset parsed from NK record used as a key
193 * to lookup reference to this SK record
194 */
195
196 uint32 prev_sk_off;
197 uint32 next_sk_off;
198 uint32 ref_count;
199 uint32 desc_size; /* size of security descriptor */
200 uint16 unknown_tag;
201 uint8 magic[REC_HDR_SIZE];
202} REGF_SK_REC;
203
204
205/* Key Name */
206typedef struct
207{
208 uint32 offset; /* Real offset of this record's cell in the file */
209 uint32 cell_size; /* Actual or estimated length of the cell.
210 * Always in multiples of 8.
211 */
212
213 /* link in the other records here */
214 REGF_VK_REC** values;
215 REGF_HASH_LIST* subkeys;
216
217 /* header information */
218 /* XXX: should we be looking for types other than the root key type? */
219 uint16 key_type;
220 uint8 magic[REC_HDR_SIZE];
221 NTTIME mtime;
222 uint16 name_length;
223 uint16 classname_length;
224 char* classname;
225 char* keyname;
226 uint32 parent_off; /* back pointer in registry hive */
227 uint32 classname_off;
228
229 /* max lengths */
230 uint32 max_bytes_subkeyname; /* max subkey name * 2 */
231 uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
232 uint32 max_bytes_valuename; /* max valuename * 2 */
233 uint32 max_bytes_value; /* max value data size */
234
235 /* unknowns */
236 uint32 unknown1;
237 uint32 unknown2;
238 uint32 unknown3;
239 uint32 unk_index; /* nigel says run time index ? */
240
241 /* children */
242 uint32 num_subkeys;
243 uint32 subkeys_off; /* hash records that point to NK records */
244 uint32 num_values;
245 uint32 values_off; /* value lists which point to VK records */
246 uint32 sk_off; /* offset to SK record */
247} REGF_NK_REC;
248
249
250
251/* REGF block */
252typedef struct
253{
254 /* run time information */
255 int fd; /* file descriptor */
256 /* For sanity checking (not part of the registry header) */
257 uint32 file_length;
258 void* mem_ctx; /* memory context for run-time file access information */
259
260 /* Experimental hbin lists */
261 range_list* hbins;
262
263 /* file format information */
264 uint8 magic[REGF_MAGIC_SIZE];/* "regf" */
265 NTTIME mtime;
266 uint32 data_offset; /* offset to record in the first (or any?)
267 * hbin block
268 */
269 uint32 last_block; /* offset to last hbin block in file */
270
271 uint32 checksum; /* Stored checksum. */
272 uint32 computed_checksum; /* Our own calculation of the checksum.
273 * (XOR of bytes 0x0000 - 0x01FB)
274 */
275
276 /* unknown data structure values */
277 uint32 unknown1;
278 uint32 unknown2;
279 uint32 unknown3;
280 uint32 unknown4;
281 uint32 unknown5;
282 uint32 unknown6;
283 uint32 unknown7;
284} REGF_FILE;
285
286
287
288typedef struct
289{
290 REGF_FILE* f;
291 void_stack* key_positions;
292 lru_cache* sk_recs;
293 REGF_NK_REC* cur_key;
294 uint32 cur_subkey;
295 uint32 cur_value;
296} REGFI_ITERATOR;
297
298
299typedef struct
300{
301 REGF_NK_REC* nk;
302 uint32 cur_subkey;
303 /* We could store a cur_value here as well, but didn't see
304 * the use in it right now.
305 */
306} REGFI_ITER_POSITION;
307
308
309/******************************************************************************/
310/* Function Declarations */
311/* Main API */
312const char* regfi_type_val2str(unsigned int val);
313int regfi_type_str2val(const char* str);
314
315char* regfi_get_sacl(SEC_DESC* sec_desc);
316char* regfi_get_dacl(SEC_DESC* sec_desc);
317char* regfi_get_owner(SEC_DESC* sec_desc);
318char* regfi_get_group(SEC_DESC* sec_desc);
319
320REGF_FILE* regfi_open(const char* filename);
321int regfi_close(REGF_FILE* r);
322
323REGFI_ITERATOR* regfi_iterator_new(REGF_FILE* fh);
324void regfi_iterator_free(REGFI_ITERATOR* i);
325bool regfi_iterator_down(REGFI_ITERATOR* i);
326bool regfi_iterator_up(REGFI_ITERATOR* i);
327bool regfi_iterator_to_root(REGFI_ITERATOR* i);
328
329bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
330 const char* subkey_name);
331bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
332 const char** path);
333const REGF_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
334const REGF_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
335const REGF_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
336const REGF_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
337const REGF_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
338
339bool regfi_iterator_find_value(REGFI_ITERATOR* i,
340 const char* value_name);
341const REGF_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
342const REGF_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
343const REGF_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
344
345/************************************/
346/* Low-layer data structure access */
347/************************************/
348REGF_FILE* regfi_parse_regf(int fd, bool strict);
349REGF_HBIN* regfi_parse_hbin(REGF_FILE* file, uint32 offset,
350 bool strict);
351
352
353/* regfi_parse_nk: Parses an NK record.
354 *
355 * Arguments:
356 * f -- the registry file structure
357 * offset -- the offset of the cell (not the record) to be parsed.
358 * max_size -- the maximum size the NK cell could be. (for validation)
359 * strict -- if true, rejects any malformed records. Otherwise,
360 * tries to minimally validate integrity.
361 * Returns:
362 * A newly allocated NK record structure, or NULL on failure.
363 */
364REGF_NK_REC* regfi_parse_nk(REGF_FILE* file, uint32 offset,
365 uint32 max_size, bool strict);
366
367
368/* Private Functions */
369REGF_NK_REC* regfi_rootkey(REGF_FILE* file);
370void regfi_key_free(REGF_NK_REC* nk);
371uint32 regfi_read(int fd, uint8* buf, uint32* length);
372
373
374
375/****************/
376/* Experimental */
377/****************/
378REGF_NK_REC* regfi_load_key(REGF_FILE* file, uint32 offset, bool strict);
379
380REGF_HASH_LIST* regfi_load_hashlist(REGF_FILE* file, uint32 offset,
381 uint32 num_keys, uint32 max_size,
382 bool strict);
383
384REGF_VK_REC** regfi_load_valuelist(REGF_FILE* file, uint32 offset,
385 uint32 num_values, uint32 max_size,
386 bool strict);
387
388REGF_VK_REC* regfi_parse_vk(REGF_FILE* file, uint32 offset,
389 uint32 max_size, bool strict);
390
391uint8* regfi_parse_data(REGF_FILE* file, uint32 offset,
392 uint32 length, bool strict);
393
394REGF_SK_REC* regfi_parse_sk(REGF_FILE* file, uint32 offset, uint32 max_size, bool strict);
395
396range_list* regfi_parse_unalloc_cells(REGF_FILE* file);
397
398REGF_HBIN* regfi_lookup_hbin(REGF_FILE* file, uint32 offset);
399
400bool regfi_parse_cell(int fd, uint32 offset, uint8* hdr, uint32 hdr_len,
401 uint32* cell_length, bool* unalloc);
402
403#endif /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.