[30] | 1 | /* |
---|
[134] | 2 | * Branched from Samba project Subversion repository, version #6903: |
---|
[84] | 3 | * http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto |
---|
[30] | 4 | * |
---|
[134] | 5 | * Windows NT (and later) registry parsing library |
---|
[30] | 6 | * |
---|
[132] | 7 | * Copyright (C) 2005-2009 Timothy D. Morgan |
---|
[30] | 8 | * Copyright (C) 2005 Gerald (Jerry) Carter |
---|
| 9 | * |
---|
| 10 | * This program is free software; you can redistribute it and/or modify |
---|
| 11 | * it under the terms of the GNU General Public License as published by |
---|
[134] | 12 | * the Free Software Foundation; version 3 of the License. |
---|
[30] | 13 | * |
---|
| 14 | * This program is distributed in the hope that it will be useful, |
---|
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 17 | * GNU General Public License for more details. |
---|
| 18 | * |
---|
| 19 | * You should have received a copy of the GNU General Public License |
---|
| 20 | * along with this program; if not, write to the Free Software |
---|
| 21 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
| 22 | * |
---|
| 23 | * $Id: regfi.h 167 2010-02-05 11:01:18Z tim $ |
---|
| 24 | */ |
---|
| 25 | |
---|
| 26 | /************************************************************ |
---|
| 27 | * Most of this information was obtained from |
---|
| 28 | * http://www.wednesday.demon.co.uk/dosreg.html |
---|
| 29 | * Thanks Nigel! |
---|
| 30 | ***********************************************************/ |
---|
| 31 | |
---|
[78] | 32 | #ifndef _REGFI_H |
---|
| 33 | #define _REGFI_H |
---|
[30] | 34 | |
---|
[31] | 35 | #include <stdlib.h> |
---|
| 36 | #include <stdio.h> |
---|
[30] | 37 | #include <stdbool.h> |
---|
[136] | 38 | #include <stdarg.h> |
---|
[31] | 39 | #include <string.h> |
---|
[30] | 40 | #include <errno.h> |
---|
[31] | 41 | #include <time.h> |
---|
[30] | 42 | #include <fcntl.h> |
---|
| 43 | #include <sys/stat.h> |
---|
| 44 | #include <sys/types.h> |
---|
| 45 | #include <unistd.h> |
---|
| 46 | #include <assert.h> |
---|
[159] | 47 | #include <iconv.h> |
---|
[30] | 48 | |
---|
[147] | 49 | #include "talloc.h" |
---|
[30] | 50 | #include "smb_deps.h" |
---|
[132] | 51 | #include "winsec.h" |
---|
[78] | 52 | #include "void_stack.h" |
---|
[99] | 53 | #include "range_list.h" |
---|
[108] | 54 | #include "lru_cache.h" |
---|
[30] | 55 | |
---|
| 56 | /******************************************************************************/ |
---|
[138] | 57 | |
---|
| 58 | /* regfi library error message types */ |
---|
| 59 | #define REGFI_MSG_INFO 0x0001 |
---|
| 60 | #define REGFI_MSG_WARN 0x0004 |
---|
| 61 | #define REGFI_MSG_ERROR 0x0010 |
---|
| 62 | |
---|
[161] | 63 | typedef uint8 REGFI_ENCODING; |
---|
| 64 | /* regfi library supported character encodings */ |
---|
| 65 | #define REGFI_ENCODING_ASCII 0 |
---|
| 66 | #define REGFI_ENCODING_UTF8 1 |
---|
| 67 | #define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII |
---|
| 68 | /* UTF16LE is not supported for output */ |
---|
| 69 | #define REGFI_ENCODING_UTF16LE 2 |
---|
| 70 | |
---|
| 71 | #define REGFI_NUM_ENCODINGS 3 |
---|
| 72 | |
---|
[143] | 73 | /* Windows is lame */ |
---|
| 74 | #ifdef O_BINARY |
---|
| 75 | #define REGFI_OPEN_FLAGS O_RDONLY|O_BINARY |
---|
| 76 | #else |
---|
| 77 | #define REGFI_OPEN_FLAGS O_RDONLY |
---|
| 78 | #endif |
---|
| 79 | |
---|
[32] | 80 | /* Registry data types */ |
---|
| 81 | #define REG_NONE 0 |
---|
| 82 | #define REG_SZ 1 |
---|
| 83 | #define REG_EXPAND_SZ 2 |
---|
| 84 | #define REG_BINARY 3 |
---|
| 85 | #define REG_DWORD 4 |
---|
[54] | 86 | #define REG_DWORD_LE 4 /* DWORD, little endian */ |
---|
| 87 | #define REG_DWORD_BE 5 /* DWORD, big endian */ |
---|
[32] | 88 | #define REG_LINK 6 |
---|
| 89 | #define REG_MULTI_SZ 7 |
---|
| 90 | #define REG_RESOURCE_LIST 8 |
---|
| 91 | #define REG_FULL_RESOURCE_DESCRIPTOR 9 |
---|
| 92 | #define REG_RESOURCE_REQUIREMENTS_LIST 10 |
---|
[72] | 93 | #define REG_QWORD 11 /* 64-bit little endian */ |
---|
| 94 | /* XXX: Has MS defined a REG_QWORD_BE? */ |
---|
[32] | 95 | /* Not a real type in the registry */ |
---|
[136] | 96 | #define REG_KEY 0x7FFFFFFF |
---|
[32] | 97 | |
---|
[135] | 98 | #define REGFI_OFFSET_NONE 0xffffffff |
---|
[30] | 99 | |
---|
[165] | 100 | |
---|
| 101 | /* This maximum depth is described here: |
---|
| 102 | * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx |
---|
| 103 | */ |
---|
| 104 | #define REGFI_MAX_DEPTH 512 |
---|
| 105 | |
---|
| 106 | /* This limit defines the maximum number of levels deep that ri subkey list |
---|
| 107 | * trees can go. |
---|
| 108 | */ |
---|
| 109 | /* XXX: This is totally arbitrary right now. |
---|
| 110 | * The actual limit may need to be discovered by experimentation. |
---|
| 111 | */ |
---|
[149] | 112 | #define REGFI_MAX_SUBKEY_DEPTH 255 |
---|
[139] | 113 | |
---|
[165] | 114 | |
---|
[135] | 115 | /* Header sizes and magic number lengths for various records */ |
---|
[147] | 116 | #define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */ |
---|
| 117 | #define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */ |
---|
[135] | 118 | #define REGFI_REGF_MAGIC_SIZE 4 |
---|
[151] | 119 | #define REGFI_REGF_NAME_SIZE 64 |
---|
| 120 | #define REGFI_REGF_RESERVED1_SIZE 340 |
---|
| 121 | #define REGFI_REGF_RESERVED2_SIZE 3528 |
---|
[135] | 122 | #define REGFI_HBIN_MAGIC_SIZE 4 |
---|
| 123 | #define REGFI_CELL_MAGIC_SIZE 2 |
---|
| 124 | #define REGFI_HBIN_HEADER_SIZE 0x20 |
---|
[116] | 125 | #define REGFI_NK_MIN_LENGTH 0x4C |
---|
| 126 | #define REGFI_VK_MIN_LENGTH 0x14 |
---|
| 127 | #define REGFI_SK_MIN_LENGTH 0x14 |
---|
[127] | 128 | #define REGFI_SUBKEY_LIST_MIN_LEN 0x4 |
---|
[157] | 129 | #define REGFI_BIG_DATA_MIN_LENGTH 0xC |
---|
[30] | 130 | |
---|
[135] | 131 | |
---|
[116] | 132 | /* Constants used for validation */ |
---|
[125] | 133 | /* XXX: Can we add clock resolution validation as well as range? It has |
---|
| 134 | * been reported that Windows timestamps are never more than a |
---|
| 135 | * certain granularity (250ms?), which could be used to help |
---|
[147] | 136 | * eliminate false positives. Would need to verify this and |
---|
[125] | 137 | * perhaps conservatively implement a check. |
---|
| 138 | */ |
---|
[116] | 139 | /* Minimum time is Jan 1, 1990 00:00:00 */ |
---|
| 140 | #define REGFI_MTIME_MIN_HIGH 0x01B41E6D |
---|
| 141 | #define REGFI_MTIME_MIN_LOW 0x26F98000 |
---|
| 142 | /* Maximum time is Jan 1, 2290 00:00:00 |
---|
| 143 | * (We hope no one is using Windows by then...) |
---|
| 144 | */ |
---|
| 145 | #define REGFI_MTIME_MAX_HIGH 0x03047543 |
---|
| 146 | #define REGFI_MTIME_MAX_LOW 0xC80A4000 |
---|
[30] | 147 | |
---|
[116] | 148 | |
---|
[30] | 149 | /* Flags for the vk records */ |
---|
[162] | 150 | #define REGFI_VK_FLAG_ASCIINAME 0x0001 |
---|
[135] | 151 | #define REGFI_VK_DATA_IN_OFFSET 0x80000000 |
---|
[152] | 152 | #define REGFI_VK_MAX_DATA_LENGTH 1024*1024 /* XXX: This is arbitrary */ |
---|
[30] | 153 | |
---|
[137] | 154 | |
---|
[152] | 155 | /* Known key flags */ |
---|
| 156 | /*******************/ |
---|
[137] | 157 | /* These next two show up on normal-seeming keys in Vista and W2K3 registries */ |
---|
| 158 | #define REGFI_NK_FLAG_UNKNOWN1 0x4000 |
---|
| 159 | #define REGFI_NK_FLAG_UNKNOWN2 0x1000 |
---|
[152] | 160 | |
---|
[167] | 161 | /* This next one shows up in some Vista "software" registries */ |
---|
| 162 | /* XXX: This shows up in the following two SOFTWARE keys in Vista: |
---|
| 163 | * /Wow6432Node/Microsoft |
---|
| 164 | * /Wow6432Node/Microsoft/Cryptography |
---|
| 165 | * |
---|
| 166 | * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0 |
---|
| 167 | */ |
---|
[137] | 168 | #define REGFI_NK_FLAG_UNKNOWN3 0x0080 |
---|
[30] | 169 | |
---|
[152] | 170 | /* Predefined handle. Rumor has it that the valuelist count for this key is |
---|
| 171 | * where the handle is stored. |
---|
| 172 | * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx |
---|
| 173 | */ |
---|
| 174 | #define REGFI_NK_FLAG_PREDEF_KEY 0x0040 |
---|
[137] | 175 | |
---|
[152] | 176 | /* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */ |
---|
| 177 | #define REGFI_NK_FLAG_ASCIINAME 0x0020 |
---|
| 178 | |
---|
| 179 | /* Symlink key. |
---|
| 180 | * See: http://www.codeproject.com/KB/system/regsymlink.aspx |
---|
| 181 | */ |
---|
| 182 | #define REGFI_NK_FLAG_LINK 0x0010 |
---|
| 183 | |
---|
| 184 | /* This key cannot be deleted */ |
---|
| 185 | #define REGFI_NK_FLAG_NO_RM 0x0008 |
---|
| 186 | |
---|
| 187 | /* Root of a hive */ |
---|
| 188 | #define REGFI_NK_FLAG_ROOT 0x0004 |
---|
| 189 | |
---|
| 190 | /* Mount point of another hive. NULL/(default) value indicates which hive |
---|
| 191 | * and where in the hive it points to. |
---|
| 192 | */ |
---|
| 193 | #define REGFI_NK_FLAG_HIVE_LINK 0x0002 |
---|
| 194 | |
---|
| 195 | /* These keys shouldn't be stored on disk, according to: |
---|
| 196 | * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx |
---|
| 197 | */ |
---|
| 198 | #define REGFI_NK_FLAG_VOLATILE 0x0001 |
---|
| 199 | |
---|
| 200 | /* Useful for identifying unknown flag types */ |
---|
| 201 | #define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\ |
---|
| 202 | | REGFI_NK_FLAG_ASCIINAME\ |
---|
| 203 | | REGFI_NK_FLAG_LINK\ |
---|
| 204 | | REGFI_NK_FLAG_NO_RM\ |
---|
| 205 | | REGFI_NK_FLAG_ROOT\ |
---|
| 206 | | REGFI_NK_FLAG_HIVE_LINK\ |
---|
| 207 | | REGFI_NK_FLAG_VOLATILE\ |
---|
| 208 | | REGFI_NK_FLAG_UNKNOWN1\ |
---|
[167] | 209 | | REGFI_NK_FLAG_UNKNOWN2\ |
---|
| 210 | | REGFI_NK_FLAG_UNKNOWN3) |
---|
[152] | 211 | |
---|
[30] | 212 | /* HBIN block */ |
---|
[135] | 213 | typedef struct _regfi_hbin |
---|
[97] | 214 | { |
---|
[53] | 215 | uint32 file_off; /* my offset in the registry file */ |
---|
[84] | 216 | uint32 ref_count; /* how many active records are pointing to this |
---|
[54] | 217 | * block (not used currently) |
---|
| 218 | */ |
---|
[84] | 219 | |
---|
[53] | 220 | uint32 first_hbin_off; /* offset from first hbin block */ |
---|
[97] | 221 | uint32 block_size; /* block size of this block |
---|
| 222 | * Should be a multiple of 4096 (0x1000) |
---|
[54] | 223 | */ |
---|
[99] | 224 | uint32 next_block; /* relative offset to next block. |
---|
| 225 | * NOTE: This value may be unreliable! |
---|
[97] | 226 | */ |
---|
| 227 | |
---|
[135] | 228 | uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */ |
---|
| 229 | } REGFI_HBIN; |
---|
[30] | 230 | |
---|
[97] | 231 | |
---|
[127] | 232 | /* Subkey List -- list of key offsets and hashed names for consistency */ |
---|
[97] | 233 | typedef struct |
---|
| 234 | { |
---|
[139] | 235 | /* Virtual offset of NK record or additional subkey list, |
---|
| 236 | * depending on this list's type. |
---|
| 237 | */ |
---|
| 238 | uint32 offset; |
---|
| 239 | |
---|
[104] | 240 | uint32 hash; |
---|
[135] | 241 | } REGFI_SUBKEY_LIST_ELEM; |
---|
[30] | 242 | |
---|
[97] | 243 | |
---|
[145] | 244 | typedef struct _regfi_subkey_list |
---|
[97] | 245 | { |
---|
[139] | 246 | /* Real offset of this record's cell in the file */ |
---|
| 247 | uint32 offset; |
---|
| 248 | |
---|
| 249 | uint32 cell_size; |
---|
| 250 | |
---|
| 251 | /* Number of immediate children */ |
---|
| 252 | uint32 num_children; |
---|
| 253 | |
---|
| 254 | /* Total number of keys referenced by this list and it's children */ |
---|
| 255 | uint32 num_keys; |
---|
| 256 | |
---|
[135] | 257 | REGFI_SUBKEY_LIST_ELEM* elements; |
---|
| 258 | uint8 magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[139] | 259 | |
---|
| 260 | /* Set if the magic indicates this subkey list points to child subkey lists */ |
---|
| 261 | bool recursive_type; |
---|
[135] | 262 | } REGFI_SUBKEY_LIST; |
---|
[30] | 263 | |
---|
[97] | 264 | |
---|
[145] | 265 | typedef uint32 REGFI_VALUE_LIST_ELEM; |
---|
| 266 | typedef struct _regfi_value_list |
---|
| 267 | { |
---|
| 268 | /* Actual number of values referenced by this list. |
---|
| 269 | * May differ from parent key's num_values if there were parsing errors. |
---|
| 270 | */ |
---|
| 271 | uint32 num_values; |
---|
| 272 | |
---|
| 273 | REGFI_VALUE_LIST_ELEM* elements; |
---|
| 274 | } REGFI_VALUE_LIST; |
---|
| 275 | |
---|
| 276 | |
---|
[160] | 277 | typedef struct _regfi_classname |
---|
| 278 | { |
---|
| 279 | /* As converted to requested character encoding. */ |
---|
| 280 | char* interpreted; |
---|
| 281 | |
---|
| 282 | /* Represents raw buffer read from classname cell. */ |
---|
| 283 | uint8* raw; |
---|
| 284 | |
---|
| 285 | /* Length of the raw data. May be shorter than that indicated by parent key.*/ |
---|
| 286 | uint16 size; |
---|
| 287 | } REGFI_CLASSNAME; |
---|
| 288 | |
---|
| 289 | |
---|
[159] | 290 | typedef struct _regfi_data |
---|
| 291 | { |
---|
| 292 | uint32 type; |
---|
| 293 | |
---|
| 294 | /* Length of the raw data. */ |
---|
| 295 | uint32 size; |
---|
| 296 | |
---|
| 297 | /* This is always present, representing the raw data cell contents. */ |
---|
| 298 | uint8* raw; |
---|
| 299 | |
---|
| 300 | /* Represents the length of the interpreted value. Meaning is type-specific.*/ |
---|
| 301 | uint32 interpreted_size; |
---|
| 302 | |
---|
| 303 | /* These items represent interpreted versions of the raw attribute above. |
---|
| 304 | * Only use the appropriate member according to the type field. |
---|
| 305 | * In the event of an unknown type, use only the raw field. |
---|
| 306 | */ |
---|
| 307 | union _regfi_data_interpreted |
---|
| 308 | { |
---|
| 309 | uint8* none; /* */ |
---|
| 310 | uint8* string; |
---|
| 311 | uint8* expand_string; |
---|
| 312 | uint8* binary; /* */ |
---|
| 313 | uint32 dword; |
---|
| 314 | uint32 dword_be; |
---|
| 315 | uint8* link; |
---|
| 316 | uint8** multiple_string; |
---|
| 317 | uint64 qword; |
---|
| 318 | |
---|
| 319 | /* The following are treated as binary currently, but this may change in |
---|
| 320 | * the future as the formats become better understood. |
---|
| 321 | */ |
---|
| 322 | uint8* resource_list; |
---|
| 323 | uint8* full_resource_descriptor; |
---|
| 324 | uint8* resource_requirements_list; |
---|
| 325 | } interpreted; |
---|
| 326 | } REGFI_DATA; |
---|
| 327 | |
---|
| 328 | |
---|
[150] | 329 | /* Value record */ |
---|
[97] | 330 | typedef struct |
---|
| 331 | { |
---|
[101] | 332 | uint32 offset; /* Real offset of this record's cell in the file */ |
---|
| 333 | uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 334 | |
---|
[159] | 335 | REGFI_DATA* data; /* XXX: deprecated */ |
---|
| 336 | |
---|
[150] | 337 | char* valuename; |
---|
[160] | 338 | uint8* valuename_raw; |
---|
[101] | 339 | uint16 name_length; |
---|
[53] | 340 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 341 | |
---|
[159] | 342 | uint32 data_size; /* As reported in the VK record. May be different than |
---|
| 343 | * That obtained while parsing the data cell itself. */ |
---|
| 344 | uint32 data_off; /* Offset of data cell (virtual) */ |
---|
[53] | 345 | uint32 type; |
---|
[135] | 346 | uint8 magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[162] | 347 | uint16 flags; |
---|
[101] | 348 | uint16 unknown1; |
---|
[111] | 349 | bool data_in_offset; |
---|
[135] | 350 | } REGFI_VK_REC; |
---|
[30] | 351 | |
---|
| 352 | |
---|
| 353 | /* Key Security */ |
---|
[135] | 354 | struct _regfi_sk_rec; |
---|
[30] | 355 | |
---|
[135] | 356 | typedef struct _regfi_sk_rec |
---|
[97] | 357 | { |
---|
[111] | 358 | uint32 offset; /* Real file offset of this record */ |
---|
| 359 | uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 360 | |
---|
[134] | 361 | WINSEC_DESC* sec_desc; |
---|
[53] | 362 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 363 | |
---|
| 364 | uint32 prev_sk_off; |
---|
| 365 | uint32 next_sk_off; |
---|
| 366 | uint32 ref_count; |
---|
[102] | 367 | uint32 desc_size; /* size of security descriptor */ |
---|
| 368 | uint16 unknown_tag; |
---|
[135] | 369 | uint8 magic[REGFI_CELL_MAGIC_SIZE]; |
---|
| 370 | } REGFI_SK_REC; |
---|
[30] | 371 | |
---|
[81] | 372 | |
---|
[104] | 373 | /* Key Name */ |
---|
| 374 | typedef struct |
---|
[97] | 375 | { |
---|
[99] | 376 | uint32 offset; /* Real offset of this record's cell in the file */ |
---|
| 377 | uint32 cell_size; /* Actual or estimated length of the cell. |
---|
| 378 | * Always in multiples of 8. |
---|
| 379 | */ |
---|
[84] | 380 | |
---|
| 381 | /* link in the other records here */ |
---|
[145] | 382 | REGFI_VALUE_LIST* values; |
---|
[135] | 383 | REGFI_SUBKEY_LIST* subkeys; |
---|
[53] | 384 | |
---|
| 385 | /* header information */ |
---|
[161] | 386 | uint16 flags; |
---|
[135] | 387 | uint8 magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[53] | 388 | NTTIME mtime; |
---|
[99] | 389 | uint16 name_length; |
---|
| 390 | uint16 classname_length; |
---|
[84] | 391 | char* keyname; |
---|
[160] | 392 | uint8* keyname_raw; |
---|
[125] | 393 | uint32 parent_off; /* pointer to parent key */ |
---|
| 394 | uint32 classname_off; |
---|
[53] | 395 | |
---|
| 396 | /* max lengths */ |
---|
[54] | 397 | uint32 max_bytes_subkeyname; /* max subkey name * 2 */ |
---|
| 398 | uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */ |
---|
| 399 | uint32 max_bytes_valuename; /* max valuename * 2 */ |
---|
| 400 | uint32 max_bytes_value; /* max value data size */ |
---|
[53] | 401 | |
---|
| 402 | /* unknowns */ |
---|
[99] | 403 | uint32 unknown1; |
---|
| 404 | uint32 unknown2; |
---|
| 405 | uint32 unknown3; |
---|
[54] | 406 | uint32 unk_index; /* nigel says run time index ? */ |
---|
[53] | 407 | |
---|
| 408 | /* children */ |
---|
| 409 | uint32 num_subkeys; |
---|
[127] | 410 | uint32 subkeys_off; /* offset of subkey list that points to NK records */ |
---|
[53] | 411 | uint32 num_values; |
---|
| 412 | uint32 values_off; /* value lists which point to VK records */ |
---|
[127] | 413 | uint32 sk_off; /* offset to SK record */ |
---|
[135] | 414 | } REGFI_NK_REC; |
---|
[30] | 415 | |
---|
[81] | 416 | |
---|
[97] | 417 | |
---|
[30] | 418 | /* REGF block */ |
---|
[97] | 419 | typedef struct |
---|
| 420 | { |
---|
[135] | 421 | /* Run-time information */ |
---|
| 422 | /************************/ |
---|
[138] | 423 | /* file descriptor */ |
---|
| 424 | int fd; |
---|
[99] | 425 | |
---|
[138] | 426 | /* For sanity checking (not part of the registry header) */ |
---|
| 427 | uint32 file_length; |
---|
| 428 | |
---|
| 429 | /* Metadata about hbins */ |
---|
[99] | 430 | range_list* hbins; |
---|
| 431 | |
---|
[146] | 432 | /* SK record cached since they're repeatedly reused */ |
---|
| 433 | lru_cache* sk_cache; |
---|
| 434 | |
---|
[135] | 435 | /* Error/warning/info messages returned by lower layer functions */ |
---|
| 436 | char* last_message; |
---|
| 437 | |
---|
[138] | 438 | /* Mask for error message types that will be stored. */ |
---|
| 439 | uint16 msg_mask; |
---|
[135] | 440 | |
---|
| 441 | |
---|
| 442 | /* Data parsed from file header */ |
---|
| 443 | /********************************/ |
---|
| 444 | uint8 magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */ |
---|
[151] | 445 | |
---|
| 446 | /* These sequence numbers should match if |
---|
| 447 | * the hive was properly synced to disk. |
---|
| 448 | */ |
---|
| 449 | uint32 sequence1; |
---|
| 450 | uint32 sequence2; |
---|
| 451 | |
---|
[84] | 452 | NTTIME mtime; |
---|
[152] | 453 | uint32 major_version; /* Set to 1 in all known hives */ |
---|
| 454 | uint32 minor_version; /* Set to 3 or 5 in all known hives */ |
---|
[151] | 455 | uint32 type; /* XXX: Unverified. Set to 0 in all known hives */ |
---|
| 456 | uint32 format; /* XXX: Unverified. Set to 1 in all known hives */ |
---|
[97] | 457 | |
---|
[151] | 458 | uint32 root_cell; /* Offset to root cell in the first (or any?) hbin block */ |
---|
[152] | 459 | uint32 last_block; /* Offset to last hbin block in file */ |
---|
[151] | 460 | |
---|
| 461 | uint32 cluster; /* XXX: Unverified. Set to 1 in all known hives */ |
---|
| 462 | |
---|
| 463 | /* Matches hive's base file name. Stored in UTF-16LE */ |
---|
| 464 | uint8 file_name[REGFI_REGF_NAME_SIZE]; |
---|
| 465 | |
---|
| 466 | WINSEC_UUID* rm_id; /* XXX: Unverified. */ |
---|
| 467 | WINSEC_UUID* log_id; /* XXX: Unverified. */ |
---|
| 468 | WINSEC_UUID* tm_id; /* XXX: Unverified. */ |
---|
| 469 | uint32 flags; /* XXX: Unverified. */ |
---|
| 470 | uint32 guid_signature; /* XXX: Unverified. */ |
---|
| 471 | |
---|
| 472 | uint32 checksum; /* Stored checksum from file */ |
---|
| 473 | uint32 computed_checksum; /* Our own calculation of the checksum. |
---|
| 474 | * (XOR of bytes 0x0000 - 0x01FB) */ |
---|
| 475 | |
---|
| 476 | WINSEC_UUID* thaw_tm_id; /* XXX: Unverified. */ |
---|
| 477 | WINSEC_UUID* thaw_rm_id; /* XXX: Unverified. */ |
---|
| 478 | WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */ |
---|
| 479 | uint32 boot_type; /* XXX: Unverified. */ |
---|
| 480 | uint32 boot_recover; /* XXX: Unverified. */ |
---|
| 481 | |
---|
| 482 | /* This seems to include random junk. Possibly unsanitized memory left over |
---|
| 483 | * from when header block was written. For instance, chunks of nk records |
---|
| 484 | * can be found, though often it's all 0s. */ |
---|
| 485 | uint8 reserved1[REGFI_REGF_RESERVED1_SIZE]; |
---|
| 486 | |
---|
| 487 | /* This is likely reserved and unusued currently. (Should be all 0s.) |
---|
| 488 | * Included here for easier access in looking for hidden data |
---|
| 489 | * or doing research. */ |
---|
| 490 | uint8 reserved2[REGFI_REGF_RESERVED2_SIZE]; |
---|
| 491 | |
---|
[135] | 492 | } REGFI_FILE; |
---|
[30] | 493 | |
---|
| 494 | |
---|
[151] | 495 | typedef struct _regfi_iterator |
---|
[97] | 496 | { |
---|
[135] | 497 | REGFI_FILE* f; |
---|
[80] | 498 | void_stack* key_positions; |
---|
[135] | 499 | REGFI_NK_REC* cur_key; |
---|
[161] | 500 | REGFI_ENCODING string_encoding; |
---|
[78] | 501 | uint32 cur_subkey; |
---|
| 502 | uint32 cur_value; |
---|
| 503 | } REGFI_ITERATOR; |
---|
| 504 | |
---|
[80] | 505 | |
---|
[151] | 506 | typedef struct _regfi_iter_position |
---|
[97] | 507 | { |
---|
[135] | 508 | REGFI_NK_REC* nk; |
---|
[80] | 509 | uint32 cur_subkey; |
---|
| 510 | /* We could store a cur_value here as well, but didn't see |
---|
| 511 | * the use in it right now. |
---|
| 512 | */ |
---|
| 513 | } REGFI_ITER_POSITION; |
---|
| 514 | |
---|
| 515 | |
---|
[151] | 516 | typedef struct _regfi_buffer |
---|
| 517 | { |
---|
| 518 | uint8* buf; |
---|
| 519 | uint32_t len; |
---|
| 520 | } REGFI_BUFFER; |
---|
| 521 | |
---|
| 522 | |
---|
[157] | 523 | |
---|
[159] | 524 | |
---|
[54] | 525 | /******************************************************************************/ |
---|
[135] | 526 | /* Main iterator API */ |
---|
| 527 | /******************************************************************************/ |
---|
[166] | 528 | |
---|
| 529 | /* regfi_open: Attempts to open a registry hive and allocate related data |
---|
| 530 | * structures. |
---|
| 531 | * |
---|
| 532 | * Arguments: |
---|
| 533 | * filename -- A string containing the relative or absolute path of the |
---|
| 534 | * registry hive to be opened. |
---|
| 535 | * |
---|
| 536 | * Returns: |
---|
| 537 | * A reference to a newly allocated REGFI_FILE structure, if successful. |
---|
| 538 | * NULL on error. |
---|
| 539 | */ |
---|
[135] | 540 | REGFI_FILE* regfi_open(const char* filename); |
---|
[32] | 541 | |
---|
[166] | 542 | |
---|
| 543 | /* regfi_alloc: Parses file headers of an already open registry hive file and |
---|
| 544 | * allocates related structures for further parsing. |
---|
| 545 | * |
---|
| 546 | * Arguments: |
---|
| 547 | * fd -- A file descriptor of an already open file. Must be seekable. |
---|
| 548 | * |
---|
| 549 | * Returns: |
---|
| 550 | * A reference to a newly allocated REGFI_FILE structure, if successful. |
---|
| 551 | * NULL on error. |
---|
| 552 | */ |
---|
| 553 | REGFI_FILE* regfi_alloc(int fd); |
---|
| 554 | |
---|
| 555 | |
---|
| 556 | /* regfi_close: Closes and frees an open registry hive. |
---|
| 557 | * |
---|
| 558 | * Arguments: |
---|
| 559 | * file -- The registry structure to close. |
---|
| 560 | * |
---|
| 561 | * Returns: |
---|
| 562 | * 0 on success, -1 on failure with errno set. |
---|
| 563 | * errno codes are similar to those of close(2). |
---|
| 564 | */ |
---|
| 565 | int regfi_close(REGFI_FILE* file); |
---|
| 566 | |
---|
| 567 | |
---|
| 568 | /* regfi_free: Frees a hive's data structures without closing the underlying |
---|
| 569 | * file. |
---|
| 570 | * |
---|
| 571 | * Arguments: |
---|
| 572 | * file -- The registry structure to free. |
---|
| 573 | */ |
---|
| 574 | void regfi_free(REGFI_FILE* file); |
---|
| 575 | |
---|
| 576 | |
---|
[136] | 577 | /* regfi_get_messages: Get errors, warnings, and/or verbose information |
---|
| 578 | * relating to processing of the given registry file. |
---|
[135] | 579 | * |
---|
| 580 | * Arguments: |
---|
| 581 | * file -- the structure for the registry file |
---|
| 582 | * |
---|
| 583 | * Returns: |
---|
| 584 | * A newly allocated char* which must be free()d by the caller. |
---|
| 585 | */ |
---|
[136] | 586 | char* regfi_get_messages(REGFI_FILE* file); |
---|
[159] | 587 | |
---|
[166] | 588 | |
---|
| 589 | /* regfi_set_message_mask: Set the verbosity level of errors and warnings |
---|
| 590 | * generated by the library |
---|
| 591 | * (as accessible via regfi_get_messages). |
---|
| 592 | * |
---|
| 593 | * Arguments: |
---|
| 594 | * file -- the structure for the registry file |
---|
| 595 | * mask -- an integer representing the types of messages desired. |
---|
| 596 | * Acceptable values are created through bitwise ORs of |
---|
| 597 | * REGFI_MSG_* values. For instance, if only errors and |
---|
| 598 | * informational messages were desired (but not warnings), |
---|
| 599 | * then one would specify: REGFI_MSG_ERROR|REGFI_MSG_INFO |
---|
| 600 | * New REGFI_FILE structures are created with: |
---|
| 601 | * REGFI_MSG_ERROR|REGFI_MSG_WARN |
---|
| 602 | * Note that error and warning messages will continue to |
---|
| 603 | * accumulate in memory if they are not fetched using |
---|
| 604 | * regfi_get_messages and then freed by the caller. |
---|
| 605 | * To disable error messages entirely, supply 0, which |
---|
| 606 | * will prevent message accumulation. |
---|
| 607 | * |
---|
| 608 | * This may be called at any time and will take effect immediately. |
---|
| 609 | */ |
---|
[138] | 610 | void regfi_set_message_mask(REGFI_FILE* file, uint16 mask); |
---|
[53] | 611 | |
---|
[159] | 612 | |
---|
| 613 | /* regfi_iterator_new: Creates a new iterator for the provided registry file. |
---|
| 614 | * |
---|
| 615 | * Arguments: |
---|
| 616 | * file -- The opened registry file the iterator should be |
---|
| 617 | * created for. |
---|
[161] | 618 | * output_encoding -- Character encoding that strings should be returned in. |
---|
| 619 | * Only supply the REGFI_ENCODING_* constants, as others |
---|
| 620 | * will be rejected. |
---|
[159] | 621 | * The following values are currently accepted: |
---|
[161] | 622 | * REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII) |
---|
| 623 | * REGFI_ENCODING_ASCII |
---|
| 624 | * REGFI_ENCODING_UTF8 |
---|
[159] | 625 | * |
---|
| 626 | * Returns: |
---|
| 627 | * A newly allocated REGFI_ITERATOR. Must be free()d with regfi_iterator_free. |
---|
| 628 | */ |
---|
| 629 | REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* file, |
---|
[161] | 630 | REGFI_ENCODING output_encoding); |
---|
[166] | 631 | |
---|
| 632 | |
---|
| 633 | /* regfi_iterator_free: Frees a registry file iterator previously created by |
---|
| 634 | * regfi_iterator_new. |
---|
| 635 | * |
---|
| 636 | * This does not affect the underlying registry file's allocation status. |
---|
| 637 | * |
---|
| 638 | * Arguments: |
---|
| 639 | * file -- the iterator to be freed |
---|
| 640 | */ |
---|
[84] | 641 | void regfi_iterator_free(REGFI_ITERATOR* i); |
---|
[166] | 642 | |
---|
| 643 | |
---|
| 644 | /* regfi_iterator_down: Traverse deeper into the registry tree at the |
---|
| 645 | * current subkey. |
---|
| 646 | * |
---|
| 647 | * Arguments: |
---|
| 648 | * i -- the iterator |
---|
| 649 | * |
---|
| 650 | * Returns: |
---|
| 651 | * true on success, false on failure. Note that subkey and value indexes |
---|
| 652 | * are preserved. That is, if a regfi_iterator_up call occurs later |
---|
| 653 | * (reversing the effect of this call) then the subkey and value referenced |
---|
| 654 | * prior to the regfi_iterator_down call will still be referenced. This |
---|
| 655 | * makes depth-first iteration particularly easy. |
---|
| 656 | */ |
---|
[84] | 657 | bool regfi_iterator_down(REGFI_ITERATOR* i); |
---|
[166] | 658 | |
---|
| 659 | |
---|
| 660 | /* regfi_iterator_up: Traverse up to the current key's parent key. |
---|
| 661 | * |
---|
| 662 | * Arguments: |
---|
| 663 | * i -- the iterator |
---|
| 664 | * |
---|
| 665 | * Returns: |
---|
| 666 | * true on success, false on failure. Any subkey or value state |
---|
| 667 | * associated with the current key is lost. |
---|
| 668 | */ |
---|
[84] | 669 | bool regfi_iterator_up(REGFI_ITERATOR* i); |
---|
[166] | 670 | |
---|
| 671 | |
---|
| 672 | /* regfi_iterator_to_root: Traverse up to the root key of the hive. |
---|
| 673 | * |
---|
| 674 | * Arguments: |
---|
| 675 | * i -- the iterator |
---|
| 676 | * |
---|
| 677 | * Returns: |
---|
| 678 | * true on success, false on failure. |
---|
| 679 | */ |
---|
[84] | 680 | bool regfi_iterator_to_root(REGFI_ITERATOR* i); |
---|
[30] | 681 | |
---|
[166] | 682 | |
---|
| 683 | /* regfi_iterator_walk_path: Traverse down multiple levels in the registry hive. |
---|
| 684 | * |
---|
| 685 | * Arguments: |
---|
| 686 | * i -- the iterator |
---|
| 687 | * path -- a list of key names representing the path. This list must |
---|
| 688 | * contain NUL terminated strings. The list itself is |
---|
| 689 | * terminated with a NULL pointer. All path elements must be |
---|
| 690 | * keys; value names are not accepted (even as the last |
---|
| 691 | * element). |
---|
| 692 | * |
---|
| 693 | * XXX: This currently only accepts ASCII key names. Need to look into |
---|
| 694 | * accepting other encodings. |
---|
| 695 | * |
---|
| 696 | * Returns: |
---|
| 697 | * true on success, false on failure. If any element of path is not found, |
---|
| 698 | * false will be returned and the iterator will remain in its original |
---|
| 699 | * position. |
---|
| 700 | */ |
---|
[84] | 701 | bool regfi_iterator_walk_path(REGFI_ITERATOR* i, |
---|
| 702 | const char** path); |
---|
[166] | 703 | |
---|
| 704 | |
---|
| 705 | /* regfi_iterator_cur_key: Returns the currently referenced key. |
---|
| 706 | * |
---|
| 707 | * Arguments: |
---|
| 708 | * i -- the iterator |
---|
| 709 | * |
---|
| 710 | * Returns: |
---|
| 711 | * A read-only key structure for the current key, or NULL on failure. |
---|
| 712 | */ |
---|
[135] | 713 | const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i); |
---|
[166] | 714 | |
---|
| 715 | |
---|
| 716 | /* regfi_iterator_cur_sk: Returns the SK (security) record referenced by the |
---|
| 717 | * current key. |
---|
| 718 | * |
---|
| 719 | * Arguments: |
---|
| 720 | * i -- the iterator |
---|
| 721 | * |
---|
| 722 | * Returns: |
---|
| 723 | * A read-only SK structure, or NULL on failure. |
---|
| 724 | */ |
---|
[135] | 725 | const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i); |
---|
[80] | 726 | |
---|
[166] | 727 | |
---|
| 728 | /* regfi_iterator_first_subkey: Sets the internal subkey index to the first |
---|
[167] | 729 | * subkey referenced by the current key and returns |
---|
| 730 | * that key. |
---|
[166] | 731 | * |
---|
| 732 | * Arguments: |
---|
| 733 | * i -- the iterator |
---|
| 734 | * |
---|
| 735 | * Returns: |
---|
[167] | 736 | * A newly allocated key structure for the newly referenced first subkey, or |
---|
| 737 | * NULL on failure. Failure may be due to a lack of any subkeys or other |
---|
| 738 | * errors. Newly allocated keys must be freed with regfi_free_key. |
---|
[166] | 739 | */ |
---|
[150] | 740 | REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i); |
---|
[166] | 741 | |
---|
| 742 | |
---|
| 743 | /* regfi_iterator_cur_subkey: Returns the currently indexed subkey. |
---|
| 744 | * |
---|
| 745 | * Arguments: |
---|
| 746 | * i -- the iterator |
---|
| 747 | * |
---|
| 748 | * Returns: |
---|
| 749 | * A newly allocated key structure for the currently referenced subkey, |
---|
| 750 | * or NULL on failure. Newly allocated keys must be freed with |
---|
| 751 | * regfi_free_key. |
---|
| 752 | */ |
---|
[150] | 753 | REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i); |
---|
[167] | 754 | |
---|
| 755 | |
---|
| 756 | /* regfi_iterator_next_subkey: Increments the internal subkey index to the next |
---|
| 757 | * key in the subkey-list and returns the subkey |
---|
| 758 | * for that index. |
---|
| 759 | * |
---|
| 760 | * Arguments: |
---|
| 761 | * i -- the iterator |
---|
| 762 | * |
---|
| 763 | * Returns: |
---|
| 764 | * A newly allocated key structure for the next subkey or NULL on |
---|
| 765 | * failure. Newly allocated keys must be freed with |
---|
| 766 | * regfi_free_key. |
---|
| 767 | */ |
---|
[150] | 768 | REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i); |
---|
[167] | 769 | |
---|
| 770 | |
---|
| 771 | /* regfi_iterator_find_subkey: Searches for a subkey with a given name under the |
---|
| 772 | * current key. |
---|
| 773 | * |
---|
| 774 | * Arguments: |
---|
| 775 | * i -- the iterator |
---|
| 776 | * subkey_name -- subkey name to search for |
---|
| 777 | * |
---|
| 778 | * Returns: |
---|
| 779 | * True if such a subkey was found, false otherwise. If a subkey is found, |
---|
| 780 | * the current subkey index is set to that subkey. Otherwise, the subkey |
---|
| 781 | * index remains at the same location as before the call. |
---|
| 782 | */ |
---|
[157] | 783 | bool regfi_iterator_find_subkey(REGFI_ITERATOR* i, |
---|
| 784 | const char* subkey_name); |
---|
[150] | 785 | |
---|
[167] | 786 | /* regfi_iterator_first_value: Sets the internal value index to the first |
---|
| 787 | * value referenced by the current key and returns |
---|
| 788 | * that value. |
---|
| 789 | * |
---|
| 790 | * Arguments: |
---|
| 791 | * i -- the iterator |
---|
| 792 | * |
---|
| 793 | * Returns: |
---|
| 794 | * A newly allocated value structure for the newly referenced first value, |
---|
| 795 | * or NULL on failure. Failure may be due to a lack of any values or other |
---|
| 796 | * errors. Newly allocated keys must be freed with regfi_free_value. |
---|
| 797 | */ |
---|
[150] | 798 | REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i); |
---|
[167] | 799 | |
---|
| 800 | |
---|
| 801 | /* regfi_iterator_cur_value: Returns the currently indexed value. |
---|
| 802 | * |
---|
| 803 | * Arguments: |
---|
| 804 | * i -- the iterator |
---|
| 805 | * |
---|
| 806 | * Returns: |
---|
| 807 | * A newly allocated value structure for the currently referenced value, |
---|
| 808 | * or NULL on failure. Newly allocated values must be freed with |
---|
| 809 | * regfi_free_value. |
---|
| 810 | */ |
---|
[150] | 811 | REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i); |
---|
[167] | 812 | |
---|
| 813 | |
---|
| 814 | /* regfi_iterator_next_value: Increments the internal value index to the next |
---|
| 815 | * value in the value-list and returns the value |
---|
| 816 | * for that index. |
---|
| 817 | * |
---|
| 818 | * Arguments: |
---|
| 819 | * i -- the iterator |
---|
| 820 | * |
---|
| 821 | * Returns: |
---|
| 822 | * A newly allocated key structure for the next value or NULL on failure. |
---|
| 823 | * Newly allocated keys must be freed with regfi_free_value. |
---|
| 824 | */ |
---|
[150] | 825 | REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i); |
---|
[167] | 826 | |
---|
| 827 | |
---|
| 828 | /* regfi_iterator_find_value: Searches for a value with a given name under the |
---|
| 829 | * current key. |
---|
| 830 | * |
---|
| 831 | * Arguments: |
---|
| 832 | * i -- the iterator |
---|
| 833 | * value_name -- value name to search for |
---|
| 834 | * |
---|
| 835 | * Returns: |
---|
| 836 | * True if such a value was found, false otherwise. If a value is found, |
---|
| 837 | * the current value index is set to that value. Otherwise, the value |
---|
| 838 | * index remains at the same location as before the call. |
---|
| 839 | */ |
---|
[157] | 840 | bool regfi_iterator_find_value(REGFI_ITERATOR* i, |
---|
| 841 | const char* value_name); |
---|
[80] | 842 | |
---|
[167] | 843 | |
---|
| 844 | /* regfi_iterator_fetch_classname: Retrieves classname for a given key. |
---|
| 845 | * |
---|
| 846 | * Arguments: |
---|
| 847 | * i -- the iterator |
---|
| 848 | * key -- the key whose classname is desired |
---|
| 849 | * |
---|
| 850 | * Returns: |
---|
| 851 | * Returns a newly allocated classname structure, or NULL on failure. |
---|
| 852 | * Classname structures must be freed with regfi_free_classname. |
---|
| 853 | */ |
---|
[160] | 854 | REGFI_CLASSNAME* regfi_iterator_fetch_classname(REGFI_ITERATOR* i, |
---|
| 855 | const REGFI_NK_REC* key); |
---|
[167] | 856 | |
---|
| 857 | |
---|
| 858 | /* regfi_iterator_fetch_data: Retrieves data for a given value. |
---|
| 859 | * |
---|
| 860 | * Arguments: |
---|
| 861 | * i -- the iterator |
---|
| 862 | * value -- the value whose data is desired |
---|
| 863 | * |
---|
| 864 | * Returns: |
---|
| 865 | * Returns a newly allocated data structure, or NULL on failure. |
---|
| 866 | * Data structures must be freed with regfi_free_data. |
---|
| 867 | */ |
---|
[159] | 868 | REGFI_DATA* regfi_iterator_fetch_data(REGFI_ITERATOR* i, |
---|
| 869 | const REGFI_VK_REC* value); |
---|
[127] | 870 | |
---|
[157] | 871 | |
---|
[127] | 872 | /********************************************************/ |
---|
[146] | 873 | /* Middle-layer structure loading, linking, and caching */ |
---|
[127] | 874 | /********************************************************/ |
---|
[135] | 875 | REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32 offset, |
---|
[161] | 876 | REGFI_ENCODING output_encoding, |
---|
[135] | 877 | bool strict); |
---|
[145] | 878 | REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32 offset, |
---|
[162] | 879 | REGFI_ENCODING output_encoding, |
---|
[145] | 880 | bool strict); |
---|
[146] | 881 | REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32 offset, |
---|
| 882 | uint32 num_keys, uint32 max_size, |
---|
| 883 | bool strict); |
---|
[145] | 884 | REGFI_VALUE_LIST* regfi_load_valuelist(REGFI_FILE* file, uint32 offset, |
---|
[146] | 885 | uint32 num_values, uint32 max_size, |
---|
[135] | 886 | bool strict); |
---|
[127] | 887 | |
---|
[157] | 888 | REGFI_BUFFER regfi_load_data(REGFI_FILE* file, uint32 voffset, |
---|
| 889 | uint32 length, bool data_in_offset, |
---|
| 890 | bool strict); |
---|
| 891 | |
---|
| 892 | REGFI_BUFFER regfi_load_big_data(REGFI_FILE* file, uint32 offset, |
---|
| 893 | uint32 data_length,uint32 cell_length, |
---|
| 894 | range_list* used_ranges, |
---|
| 895 | bool strict); |
---|
[159] | 896 | bool regfi_interpret_data(REGFI_FILE* file, |
---|
[161] | 897 | REGFI_ENCODING string_encoding, |
---|
[159] | 898 | uint32 type, REGFI_DATA* data); |
---|
[160] | 899 | void regfi_free_classname(REGFI_CLASSNAME* classname); |
---|
[159] | 900 | void regfi_free_data(REGFI_DATA* data); |
---|
[157] | 901 | |
---|
[160] | 902 | |
---|
[146] | 903 | /* These are cached so return values don't need to be freed. */ |
---|
| 904 | const REGFI_SK_REC* regfi_load_sk(REGFI_FILE* file, uint32 offset, |
---|
| 905 | bool strict); |
---|
[157] | 906 | const REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32 offset); |
---|
[146] | 907 | |
---|
| 908 | |
---|
[99] | 909 | /************************************/ |
---|
| 910 | /* Low-layer data structure access */ |
---|
| 911 | /************************************/ |
---|
[135] | 912 | REGFI_FILE* regfi_parse_regf(int fd, bool strict); |
---|
| 913 | REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32 offset, |
---|
[110] | 914 | bool strict); |
---|
[80] | 915 | |
---|
[99] | 916 | |
---|
| 917 | /* regfi_parse_nk: Parses an NK record. |
---|
| 918 | * |
---|
| 919 | * Arguments: |
---|
| 920 | * f -- the registry file structure |
---|
| 921 | * offset -- the offset of the cell (not the record) to be parsed. |
---|
| 922 | * max_size -- the maximum size the NK cell could be. (for validation) |
---|
| 923 | * strict -- if true, rejects any malformed records. Otherwise, |
---|
| 924 | * tries to minimally validate integrity. |
---|
| 925 | * Returns: |
---|
| 926 | * A newly allocated NK record structure, or NULL on failure. |
---|
| 927 | */ |
---|
[150] | 928 | REGFI_NK_REC* regfi_parse_nk(REGFI_FILE* file, uint32 offset, |
---|
[99] | 929 | uint32 max_size, bool strict); |
---|
| 930 | |
---|
[139] | 931 | REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset, |
---|
| 932 | uint32 max_size, bool strict); |
---|
| 933 | |
---|
[135] | 934 | REGFI_VK_REC* regfi_parse_vk(REGFI_FILE* file, uint32 offset, |
---|
| 935 | uint32 max_size, bool strict); |
---|
[103] | 936 | |
---|
[135] | 937 | REGFI_SK_REC* regfi_parse_sk(REGFI_FILE* file, uint32 offset, |
---|
| 938 | uint32 max_size, bool strict); |
---|
[111] | 939 | |
---|
[135] | 940 | range_list* regfi_parse_unalloc_cells(REGFI_FILE* file); |
---|
[101] | 941 | |
---|
[135] | 942 | bool regfi_parse_cell(int fd, uint32 offset, |
---|
| 943 | uint8* hdr, uint32 hdr_len, |
---|
| 944 | uint32* cell_length, bool* unalloc); |
---|
[111] | 945 | |
---|
[160] | 946 | uint8* regfi_parse_classname(REGFI_FILE* file, uint32 offset, |
---|
[135] | 947 | uint16* name_length, |
---|
| 948 | uint32 max_size, bool strict); |
---|
[126] | 949 | |
---|
[157] | 950 | REGFI_BUFFER regfi_parse_data(REGFI_FILE* file, uint32 offset, |
---|
| 951 | uint32 length, bool strict); |
---|
| 952 | |
---|
| 953 | REGFI_BUFFER regfi_parse_little_data(REGFI_FILE* file, uint32 voffset, |
---|
| 954 | uint32 length, bool strict); |
---|
| 955 | |
---|
| 956 | |
---|
[150] | 957 | /* Dispose of previously parsed records */ |
---|
| 958 | void regfi_free_key(REGFI_NK_REC* nk); |
---|
| 959 | void regfi_free_value(REGFI_VK_REC* vk); |
---|
[127] | 960 | |
---|
[150] | 961 | |
---|
| 962 | |
---|
[135] | 963 | /************************************/ |
---|
| 964 | /* Private Functions */ |
---|
| 965 | /************************************/ |
---|
[161] | 966 | REGFI_NK_REC* regfi_rootkey(REGFI_FILE* file, |
---|
| 967 | REGFI_ENCODING output_encoding); |
---|
[135] | 968 | void regfi_subkeylist_free(REGFI_SUBKEY_LIST* list); |
---|
[127] | 969 | uint32 regfi_read(int fd, uint8* buf, uint32* length); |
---|
| 970 | |
---|
[135] | 971 | const char* regfi_type_val2str(unsigned int val); |
---|
| 972 | int regfi_type_str2val(const char* str); |
---|
[127] | 973 | |
---|
[135] | 974 | char* regfi_get_sacl(WINSEC_DESC* sec_desc); |
---|
| 975 | char* regfi_get_dacl(WINSEC_DESC* sec_desc); |
---|
| 976 | char* regfi_get_owner(WINSEC_DESC* sec_desc); |
---|
| 977 | char* regfi_get_group(WINSEC_DESC* sec_desc); |
---|
| 978 | |
---|
| 979 | REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists, |
---|
| 980 | REGFI_SUBKEY_LIST** lists, |
---|
| 981 | bool strict); |
---|
[139] | 982 | REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset, |
---|
| 983 | uint32 max_size, bool strict, |
---|
| 984 | uint8 depth_left); |
---|
[138] | 985 | void regfi_add_message(REGFI_FILE* file, uint16 msg_type, |
---|
| 986 | const char* fmt, ...); |
---|
[146] | 987 | REGFI_NK_REC* regfi_copy_nk(const REGFI_NK_REC* nk); |
---|
| 988 | REGFI_VK_REC* regfi_copy_vk(const REGFI_VK_REC* vk); |
---|
[157] | 989 | int32 regfi_calc_maxsize(REGFI_FILE* file, uint32 offset); |
---|
[161] | 990 | int32 regfi_conv_charset(const char* input_charset, |
---|
| 991 | const char* output_charset, |
---|
[159] | 992 | uint8* input, char* output, |
---|
| 993 | uint32 input_len, uint32 output_max); |
---|
| 994 | REGFI_DATA* regfi_buffer_to_data(REGFI_BUFFER raw_data); |
---|
[146] | 995 | |
---|
[78] | 996 | #endif /* _REGFI_H */ |
---|