source: trunk/include/regfi.h @ 186

Last change on this file since 186 was 186, checked in by tim, 14 years ago

minor changes based on suggestions from Michael Cohen

  • Property svn:keywords set to Id
File size: 43.3 KB
RevLine 
[169]1/*
[168]2 * Copyright (C) 2005-2010 Timothy D. Morgan
[30]3 * Copyright (C) 2005 Gerald (Jerry) Carter
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
[134]7 * the Free Software Foundation; version 3 of the License.
[30]8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17 *
18 * $Id: regfi.h 186 2010-04-19 21:55:26Z tim $
19 */
20
[169]21/**
22 * @file
23 * Windows NT (and later) read-only registry library
24 *
25 * This library is intended for use in digital forensics investigations, but
26 * is likely useful in other applications.
27 *
28 * Branched from Samba project Subversion repository, version #6903:
29 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
30 *
31 * Since then, it has been heavily rewritten, simplified, and improved.
32 */
[30]33
[168]34/**
35 * @mainpage Home
36 *
[169]37 * The regfi library is a read-only NT registry library which serves as the main
38 * engine behind the reglookup tool.  It is designed with digital forensic
39 * analysis in mind, but it should also be useful in other tools which need to
40 * efficiently traverse and query registry data structures.
41 *
42 * The library is broken down into four main parts, the
43 * @ref regfiBase "Base Layer", which any code dependent on the library will
44 * likely need to rely on, as well as three main functional layers:
45 * @li @ref regfiIteratorLayer
46 * @li @ref regfiGlueLayer
47 * @li @ref regfiParseLayer
48 *
49 * Most users will find that a combination of the Base Layer and the Iterator Layer
[185]50 * will be sufficient for accessing registry hive files.  Those who are willing
[169]51 * to dive deep into registry data structures, for instance to recover deleted
52 * data structures or to research Windows registry behavior in detail, will
53 * find the Parse Layer to be quite useful.
[168]54 */
55
[169]56
[78]57#ifndef _REGFI_H
58#define _REGFI_H
[30]59
[31]60#include <stdlib.h>
61#include <stdio.h>
[30]62#include <stdbool.h>
[31]63#include <string.h>
[30]64#include <errno.h>
[31]65#include <time.h>
[30]66#include <fcntl.h>
67#include <sys/stat.h>
68#include <sys/types.h>
69#include <unistd.h>
[159]70#include <iconv.h>
[180]71#include <pthread.h>
[30]72
[168]73#include "byteorder.h"
[147]74#include "talloc.h"
[132]75#include "winsec.h"
[78]76#include "void_stack.h"
[99]77#include "range_list.h"
[108]78#include "lru_cache.h"
[30]79
[184]80
[185]81
82
[30]83/******************************************************************************/
[184]84/* Constants for use while interacting with the library                       */
85/******************************************************************************/
[138]86
87/* regfi library error message types */
[182]88#define REGFI_LOG_INFO  0x0001
89#define REGFI_LOG_WARN  0x0004
90#define REGFI_LOG_ERROR 0x0010
[185]91#define REGFI_DEFAULT_LOG_MASK REGFI_LOG_ERROR|REGFI_LOG_WARN
[138]92
[168]93typedef uint8_t REGFI_ENCODING;
[161]94/* regfi library supported character encodings */
95#define REGFI_ENCODING_ASCII   0
96#define REGFI_ENCODING_UTF8    1
97#define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII
98/* UTF16LE is not supported for output */
99#define REGFI_ENCODING_UTF16LE 2
100
101#define REGFI_NUM_ENCODINGS    3
102
[32]103/* Registry data types */
104#define REG_NONE                       0
105#define REG_SZ                         1
106#define REG_EXPAND_SZ                  2
107#define REG_BINARY                     3
108#define REG_DWORD                      4
[54]109#define REG_DWORD_LE                   4  /* DWORD, little endian */
110#define REG_DWORD_BE                   5  /* DWORD, big endian */
[32]111#define REG_LINK                       6
112#define REG_MULTI_SZ                   7
113#define REG_RESOURCE_LIST              8
114#define REG_FULL_RESOURCE_DESCRIPTOR   9
115#define REG_RESOURCE_REQUIREMENTS_LIST 10
[72]116#define REG_QWORD                      11 /* 64-bit little endian */
117/* XXX: Has MS defined a REG_QWORD_BE? */
[32]118/* Not a real type in the registry */
[136]119#define REG_KEY                    0x7FFFFFFF
[32]120
[135]121#define REGFI_OFFSET_NONE          0xffffffff
[30]122
[165]123
[184]124
125/******************************************************************************/
126/* Various resource limits and related constants                              */
127/******************************************************************************/
128
129/* Flags determining whether or not to cache various record types internally */
130#define REGFI_CACHE_SK             0
131
[165]132/* This maximum depth is described here:
133 * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
134 */
135#define REGFI_MAX_DEPTH            512
136
137/* This limit defines the maximum number of levels deep that ri subkey list
138 * trees can go.
139 */
140/* XXX: This is totally arbitrary right now.
141 *      The actual limit may need to be discovered by experimentation.
142 */
[149]143#define REGFI_MAX_SUBKEY_DEPTH     255
[139]144
[165]145
[184]146/******************************************************************************/
147/* Symbols for internal use                                                   */
148/******************************************************************************/
149
150/* Global thread-local storage key */
[185]151pthread_key_t regfi_log_key;
[184]152
[135]153/* Header sizes and magic number lengths for various records */
[147]154#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
155#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
[135]156#define REGFI_REGF_MAGIC_SIZE      4
[151]157#define REGFI_REGF_NAME_SIZE       64
158#define REGFI_REGF_RESERVED1_SIZE  340
159#define REGFI_REGF_RESERVED2_SIZE  3528
[135]160#define REGFI_HBIN_MAGIC_SIZE      4
161#define REGFI_CELL_MAGIC_SIZE      2
162#define REGFI_HBIN_HEADER_SIZE     0x20
[116]163#define REGFI_NK_MIN_LENGTH        0x4C
164#define REGFI_VK_MIN_LENGTH        0x14
165#define REGFI_SK_MIN_LENGTH        0x14
[127]166#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
[157]167#define REGFI_BIG_DATA_MIN_LENGTH  0xC
[30]168
[135]169
[116]170/* Constants used for validation */
[125]171/* XXX: Can we add clock resolution validation as well as range?  It has
172 *      been reported that Windows timestamps are never more than a
173 *      certain granularity (250ms?), which could be used to help
[147]174 *      eliminate false positives.  Would need to verify this and
[125]175 *      perhaps conservatively implement a check.
176 */
[116]177 /* Minimum time is Jan 1, 1990 00:00:00 */
178#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
[178]179
[116]180 /* Maximum time is Jan 1, 2290 00:00:00
181  * (We hope no one is using Windows by then...)
182  */
183#define REGFI_MTIME_MAX_HIGH       0x03047543
[30]184
[116]185
[30]186/* Flags for the vk records */
[162]187#define REGFI_VK_FLAG_ASCIINAME    0x0001
[135]188#define REGFI_VK_DATA_IN_OFFSET    0x80000000
[152]189#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
[30]190
[137]191
[152]192/* Known key flags */
193/*******************/
[137]194/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
195#define REGFI_NK_FLAG_UNKNOWN1     0x4000
196#define REGFI_NK_FLAG_UNKNOWN2     0x1000
[152]197
[167]198/* This next one shows up in some Vista "software" registries */
199/* XXX: This shows up in the following two SOFTWARE keys in Vista:
200 *   /Wow6432Node/Microsoft
201 *   /Wow6432Node/Microsoft/Cryptography
202 * 
203 * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0
204 */
[137]205#define REGFI_NK_FLAG_UNKNOWN3     0x0080
[30]206
[152]207/* Predefined handle.  Rumor has it that the valuelist count for this key is
208 * where the handle is stored.
209 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
210 */
211#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
[137]212
[152]213/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
214#define REGFI_NK_FLAG_ASCIINAME    0x0020
215
216/* Symlink key. 
217 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
218 */
219#define REGFI_NK_FLAG_LINK         0x0010
220
221/* This key cannot be deleted */
222#define REGFI_NK_FLAG_NO_RM        0x0008
223
224/* Root of a hive */
225#define REGFI_NK_FLAG_ROOT         0x0004
226
227/* Mount point of another hive.  NULL/(default) value indicates which hive
228 * and where in the hive it points to.
229 */
230#define REGFI_NK_FLAG_HIVE_LINK    0x0002
231
232/* These keys shouldn't be stored on disk, according to:
233 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
234 */
235#define REGFI_NK_FLAG_VOLATILE     0x0001
236
237/* Useful for identifying unknown flag types */
238#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
239                                    | REGFI_NK_FLAG_ASCIINAME\
240                                    | REGFI_NK_FLAG_LINK\
241                                    | REGFI_NK_FLAG_NO_RM\
242                                    | REGFI_NK_FLAG_ROOT\
243                                    | REGFI_NK_FLAG_HIVE_LINK\
244                                    | REGFI_NK_FLAG_VOLATILE\
245                                    | REGFI_NK_FLAG_UNKNOWN1\
[167]246                                    | REGFI_NK_FLAG_UNKNOWN2\
247                                    | REGFI_NK_FLAG_UNKNOWN3)
[152]248
[168]249
250#define CHAR_BIT 8
251#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
252                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
253#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
254#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
255
[184]256
257
258/******************************************************************************/
259/* Structures                                                                 */
260/******************************************************************************/
261
[168]262typedef struct _regfi_nttime
263{
264  uint32_t low;
265  uint32_t high;
266} REGFI_NTTIME;
267
268
[182]269typedef struct _regfi_log
270{
271  /* Error/warning/info messages returned by lower layer functions */
272  char* messages;
273
274  /* Mask for error message types that will be stored. */
275  uint16_t msg_mask;
276
277} REGFI_LOG;
278
279
[169]280/** HBIN block information
281 * @ingroup regfiMiddleLayer
282 */
[135]283typedef struct _regfi_hbin
[97]284{
[169]285  /** Offset of this HBIN in the registry file */
286  uint32_t file_off;
[97]287
[169]288  /** Number of active records pointing to this block (not used currently) */
289  uint32_t ref_count;
290
291  /** Offset from first hbin block */
292  uint32_t first_hbin_off;
293
294  /** Block size of this block Should be a multiple of 4096 (0x1000) */
295  uint32_t block_size;
296
297  /** Relative offset to next block. 
298   *
299   * @note This value may be unreliable!
300   */
301  uint32_t next_block;
302
303  /** Magic number for the HBIN (should be "hbin"). */
304  uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
[135]305} REGFI_HBIN;
[30]306
[97]307
[127]308/* Subkey List -- list of key offsets and hashed names for consistency */
[97]309typedef struct 
310{
[139]311  /* Virtual offset of NK record or additional subkey list,
312   * depending on this list's type.
313   */
[168]314  uint32_t offset;
[139]315
[168]316  uint32_t hash;
[135]317} REGFI_SUBKEY_LIST_ELEM;
[30]318
[97]319
[169]320/** Subkey-list structure
321 * @ingroup regfiMiddleLayer
322 */
[145]323typedef struct _regfi_subkey_list
[97]324{
[139]325  /* Real offset of this record's cell in the file */
[168]326  uint32_t offset;
[139]327
[168]328  uint32_t cell_size;
[139]329 
330  /* Number of immediate children */
[168]331  uint32_t num_children; 
[139]332
333  /* Total number of keys referenced by this list and it's children */
[168]334  uint32_t num_keys;     
[139]335
[135]336  REGFI_SUBKEY_LIST_ELEM* elements;
[168]337  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
[139]338
339  /* Set if the magic indicates this subkey list points to child subkey lists */
340  bool recursive_type; 
[135]341} REGFI_SUBKEY_LIST;
[30]342
[97]343
[168]344typedef uint32_t REGFI_VALUE_LIST_ELEM;
[169]345/** Value-list structure
346 * @ingroup regfiMiddleLayer
347 */
[145]348typedef struct _regfi_value_list
349{
350  /* Actual number of values referenced by this list. 
351   * May differ from parent key's num_values if there were parsing errors.
352   */
[168]353  uint32_t num_values;
[145]354
355  REGFI_VALUE_LIST_ELEM* elements;
356} REGFI_VALUE_LIST;
357
358
[169]359/** Class name structure (used in storing SysKeys)
360 * @ingroup regfiBase
361 */
[160]362typedef struct _regfi_classname
363{
[169]364  /** As converted to requested REGFI_ENCODING */
[160]365  char* interpreted;
366
[169]367  /** Represents raw buffer read from classname cell.
368   *
369   * Length of this item is specified in the size field.
370   */
[168]371  uint8_t* raw;
[160]372
[169]373  /** Length of the raw data.
374   *
375   * May be shorter than that indicated by parent key.
376   */
[168]377  uint16_t size;
[160]378} REGFI_CLASSNAME;
379
380
[169]381/** Data record structure
382 * @ingroup regfiBase
383 */
[159]384typedef struct _regfi_data
385{
[169]386  /** Data type of this data, as indicated by the referencing VK record. */
[168]387  uint32_t type;
[159]388
[169]389  /** Length of the raw data. */
[168]390  uint32_t size;
[159]391
[169]392  /** This is always present, representing the raw data cell contents. */
[168]393  uint8_t* raw;
[159]394
[169]395  /** Represents the length of the interpreted value. Meaning is type-specific. */
[168]396  uint32_t interpreted_size;
[159]397
[169]398  /** These items represent interpreted versions of the REGFI_DATA::raw field.
399   *
400   * Only use the appropriate member according to the REGFI_DATA::type field.
401   * In the event of an unknown type, use only the REGFI_DATA::raw field.
[159]402   */
403  union _regfi_data_interpreted
404  {
[169]405    /** REG_NONE
406     *
407     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
408     * length.
409     */
410    uint8_t* none; 
411
412    /** REG_SZ
413     *
414     * Stored as a NUL terminated string.  Converted to the specified
415     * REGFI_ENCODING.
416     */
[168]417    uint8_t* string;
[169]418
419    /** REG_EXPAND_SZ
420     *
421     * Stored as a NUL terminated string.  Converted to the specified
422     * REGFI_ENCODING.
423     */
[168]424    uint8_t* expand_string;
[169]425
426    /** REG_BINARY
427     *
428     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
429     * length.
430     */
431    uint8_t* binary;
432
433    /** REG_DWORD */
[168]434    uint32_t dword;
[169]435
436    /** REG_DWORD_BE */
[168]437    uint32_t dword_be;
[169]438
439    /** REG_LINK
440     *
441     * Stored as a NUL terminated string.  Converted to the specified
442     * REGFI_ENCODING.
443     */
[168]444    uint8_t* link;
[169]445
446    /** REG_MULTI_SZ
447     *
448     * Stored as a list of uint8_t* pointers, terminated with a NULL pointer.
449     * Each string element in the list is NUL terminated, and the character set
450     * is determined by the specified REGFI_ENCODING.
451     */
[168]452    uint8_t** multiple_string;
[169]453
454    /** REG_QWORD */
[168]455    uint64_t qword;
[159]456
457    /* The following are treated as binary currently, but this may change in
458     * the future as the formats become better understood.
459     */
[169]460
461    /** REG_RESOURCE_LIST
462     *
463     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
464     * length.
465     */
[168]466    uint8_t* resource_list;
[169]467
468    /** REG_FULL_RESOURCE_DESCRIPTOR
469     *
470     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
471     * length.
472     */
[168]473    uint8_t* full_resource_descriptor;
[169]474
475    /** REG_RESOURCE_REQUIREMENTS_LIST
476     *
477     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
478     * length.
479     */
[168]480    uint8_t* resource_requirements_list;
[159]481  } interpreted;
482} REGFI_DATA;
483
484
[169]485/** Value structure
486 * @ingroup regfiBase
487 */
488typedef struct
[97]489{
[169]490  /** Real offset of this record's cell in the file */
491  uint32_t offset;     
[101]492
[169]493  /** ((start_offset - end_offset) & 0xfffffff8) */
494  uint32_t cell_size;
[159]495
[169]496  /* XXX: deprecated */
497  REGFI_DATA* data;
498
499  /** The name of this value converted to desired REGFI_ENCODING. 
500   *
501   * This conversion typically occurs automatically through REGFI_ITERATOR
502   * settings.  String is NUL terminated.
503   */
504  char*    valuename;
505
506  /** The raw value name
507   *
508   * Length of the buffer is stored in name_length.
509   */
[168]510  uint8_t* valuename_raw;
[169]511
512  /** Length of valuename_raw */
[168]513  uint16_t name_length;
[169]514
515  /** Offset from beginning of this hbin block */
516  uint32_t hbin_off;
[53]517 
[169]518  /** Size of the value's data as reported in the VK record.
519   *
520   * May be different than that obtained while parsing the data cell itself.
521   */
522  uint32_t data_size;
523
524  /** Virtual offset of data cell */
525  uint32_t data_off;
526
527  /** Value's data type */
[168]528  uint32_t type;
[169]529
530  /** VK record's magic number (should be "vk") */
[168]531  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
[169]532
533  /** VK record flags */
[168]534  uint16_t flags;
[169]535
536  /* XXX: A 2-byte field of unknown purpose stored in the VK record */
[168]537  uint16_t unknown1;
[169]538
539  /** Whether or not the data record is stored in the VK record's data_off field.
540   *
541   * This information is derived from the high bit of the raw data size field.
542   */
543  bool     data_in_offset;
[135]544} REGFI_VK_REC;
[30]545
546
547/* Key Security */
[135]548struct _regfi_sk_rec;
[30]549
[169]550/** Security structure
551 * @ingroup regfiBase
552 */
[135]553typedef struct _regfi_sk_rec
[97]554{
[169]555  /** Real file offset of this record */
556  uint32_t offset;
[111]557
[169]558  /** ((start_offset - end_offset) & 0xfffffff8) */
559  uint32_t cell_size;
560
561  /** The stored Windows security descriptor for this SK record */
[134]562  WINSEC_DESC* sec_desc;
[169]563
564  /** Offset of this record from beginning of this hbin block */
565  uint32_t hbin_off;
[53]566 
[169]567  /** Offset of the previous SK record in the linked list of SK records */
[168]568  uint32_t prev_sk_off;
[169]569
570  /** Offset of the next SK record in the linked list of SK records */
[168]571  uint32_t next_sk_off;
[169]572
573  /** Number of keys referencing this SK record */
[168]574  uint32_t ref_count;
[169]575
576  /** Size of security descriptor (sec_desc) */
577  uint32_t desc_size;
578
579  /* XXX: A 2-byte field of unknown purpose */
[168]580  uint16_t unknown_tag;
[169]581
582  /** The magic number for this record (should be "sk") */
[168]583  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
[135]584} REGFI_SK_REC;
[30]585
[81]586
[169]587/** Key structure
588 * @ingroup regfiBase
589 */
[104]590typedef struct
[97]591{
[169]592  /** Real offset of this record's cell in the file */
593  uint32_t offset;
[84]594
[169]595  /** Actual or estimated length of the cell. 
596   * Always in multiples of 8.
597   */
598  uint32_t cell_size;
599
600  /** Preloaded value-list for this key.
601   * This element is loaded automatically when using the iterator interface and
602   * possibly some lower layer interfaces.
603   */
[145]604  REGFI_VALUE_LIST* values;
[169]605
606
607  /** Preloaded subkey-list for this key.
608   * This element is loaded automatically when using the iterator interface and
609   * possibly some lower layer interfaces.
610   */
[135]611  REGFI_SUBKEY_LIST* subkeys;
[53]612 
[169]613  /** Key flags */
[168]614  uint16_t flags;
[169]615
616  /** Magic number of key (should be "nk") */
[168]617  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
[169]618
619  /** Key's last modification time */
[168]620  REGFI_NTTIME mtime;
[169]621
622  /** Length of keyname_raw */
[168]623  uint16_t name_length;
[169]624
625  /** Length of referenced classname */
[168]626  uint16_t classname_length;
[169]627
628  /** The name of this key converted to desired REGFI_ENCODING. 
629   *
630   * This conversion typically occurs automatically through REGFI_ITERATOR
631   * settings.  String is NUL terminated.
632   */
[84]633  char* keyname;
[169]634
635  /** The raw key name
636   *
637   * Length of the buffer is stored in name_length.
638   */
[168]639  uint8_t* keyname_raw;
[169]640
641  /** Virutal offset of parent key */
642  uint32_t parent_off;
643
644  /** Virutal offset of classname key */
[168]645  uint32_t classname_off;
[53]646 
[169]647  /* XXX: max subkey name * 2 */
648  uint32_t max_bytes_subkeyname;
649
650  /* XXX: max subkey classname length (as if) */
651  uint32_t max_bytes_subkeyclassname;
652
653  /* XXX: max valuename * 2 */
654  uint32_t max_bytes_valuename;
655
656  /* XXX: max value data size */
657  uint32_t max_bytes_value;
[53]658 
[169]659  /* XXX: Fields of unknown purpose */
[168]660  uint32_t unknown1;
661  uint32_t unknown2;
662  uint32_t unknown3;
663  uint32_t unk_index;               /* nigel says run time index ? */
[53]664 
[169]665  /** Number of subkeys */
[168]666  uint32_t num_subkeys;
[169]667
668  /** Virtual offset of subkey-list */
669  uint32_t subkeys_off;
670
671  /** Number of values for this key */
[168]672  uint32_t num_values;
[169]673
674  /** Virtual offset of value-list */
675  uint32_t values_off;
676
677  /** Virtual offset of SK record */
678  uint32_t sk_off;
[135]679} REGFI_NK_REC;
[30]680
[81]681
[178]682typedef struct _regfi_raw_file
683{
684  off_t    (* seek)(); /* (REGFI_RAW_FILE* self, off_t offset, int whence) */
685  ssize_t  (* read)(); /* (REGFI_RAW_FILE* self, void* buf, size_t count) */
[97]686
[178]687  uint64_t cur_off;
688  uint64_t size;
689  void*    state;
690} REGFI_RAW_FILE;
691
692
[169]693/** Registry hive file data structure
694 *
695 * This essential structure stores run-time information about a single open
696 * registry hive as well as file header (REGF block) data.  This structure
697 * also stores a list of warnings and error messages generated while parsing
698 * the registry hive.  These can be tuned using @ref regfi_set_message_mask. 
699 * Messages may be retrieved using @ref regfi_get_messages.
700 *
701 * @note If the message mask is set to record any messages, dependent code
702 *       must use @ref regfi_get_messages periodically to clear the message
703 *       queue. Otherwise, this structure will grow in size over time as
704 *       messages queue up.
705 *
706 * @ingroup regfiBase
707 */ 
[178]708typedef struct _regfi_file
[97]709{
[135]710  /* Run-time information */
711  /************************/
[178]712  /* Functions for accessing the file */
713  REGFI_RAW_FILE* cb;
[99]714
[180]715  /* Mutex for all cb access.  This is done to prevent one thread from moving
716   * the file offset while another thread is in the middle of a multi-read
717   * parsing transaction */
[186]718  pthread_mutex_t cb_lock;
[180]719
[138]720  /* For sanity checking (not part of the registry header) */
[168]721  uint32_t file_length;
[138]722
723  /* Metadata about hbins */
[99]724  range_list* hbins;
725
[180]726  /* Multiple read access allowed, write access is exclusive */
[186]727  pthread_rwlock_t hbins_lock;
[180]728
[146]729  /* SK record cached since they're repeatedly reused */
730  lru_cache* sk_cache;
731
[180]732  /* Need exclusive access for LRUs, since lookups make changes */
[186]733  pthread_mutex_t sk_lock;
[180]734
[135]735  /* Data parsed from file header */
736  /********************************/
[168]737  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
[151]738
739 /* These sequence numbers should match if
740  * the hive was properly synced to disk.
741  */
[168]742  uint32_t sequence1;           
743  uint32_t sequence2;
[151]744
[168]745  REGFI_NTTIME mtime;
746  uint32_t major_version;  /* Set to 1 in all known hives */
747  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
748  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
749  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
[97]750
[168]751  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
752  uint32_t last_block; /* Offset to last hbin block in file */
[151]753
[168]754  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
[151]755
756  /* Matches hive's base file name. Stored in UTF-16LE */
[168]757  uint8_t file_name[REGFI_REGF_NAME_SIZE];
[151]758
759  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
760  WINSEC_UUID* log_id;      /* XXX: Unverified. */
761  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
[168]762  uint32_t flags;             /* XXX: Unverified. */
763  uint32_t guid_signature;    /* XXX: Unverified. */
[151]764
[168]765  uint32_t checksum;          /* Stored checksum from file */
766  uint32_t computed_checksum; /* Our own calculation of the checksum.
[151]767                             * (XOR of bytes 0x0000 - 0x01FB) */
768
769  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
770  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
771  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
[168]772  uint32_t boot_type;         /* XXX: Unverified. */
773  uint32_t boot_recover;      /* XXX: Unverified. */
[151]774
775  /* This seems to include random junk.  Possibly unsanitized memory left over
776   * from when header block was written.  For instance, chunks of nk records
777   * can be found, though often it's all 0s. */
[168]778  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
[151]779
780  /* This is likely reserved and unusued currently.  (Should be all 0s.)
781   * Included here for easier access in looking for hidden data
782   * or doing research. */
[168]783  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
[151]784
[135]785} REGFI_FILE;
[30]786
787
[169]788/** Registry hive iterator
789 * @ingroup regfiIteratorLayer
790 */
[151]791typedef struct _regfi_iterator
[97]792{
[169]793  /** The registry hive this iterator is associated with */
[135]794  REGFI_FILE* f;
[169]795
796  /** All current parent keys and associated iterator positions */
[80]797  void_stack* key_positions;
[169]798
799  /** The current key */
[135]800  REGFI_NK_REC* cur_key;
[169]801
802  /** The encoding that all strings are converted to as set during iterator
803   *  creation.
804   */
[161]805  REGFI_ENCODING string_encoding;
[169]806
807  /** Index of the current subkey */
[168]808  uint32_t cur_subkey;
[169]809
810  /** Index of the current value */
[168]811  uint32_t cur_value;
[78]812} REGFI_ITERATOR;
813
[80]814
[151]815typedef struct _regfi_iter_position
[97]816{
[135]817  REGFI_NK_REC* nk;
[168]818  uint32_t cur_subkey;
[80]819  /* We could store a cur_value here as well, but didn't see
820   * the use in it right now.
821   */
822} REGFI_ITER_POSITION;
823
824
[169]825/** General purpose buffer with stored length
826 * @ingroup regfiBottomLayer
827 */
[151]828typedef struct _regfi_buffer
829{
[168]830  uint8_t* buf;
[151]831  uint32_t len;
832} REGFI_BUFFER;
833
834
[169]835
[54]836/******************************************************************************/
[168]837/**
[169]838 * @defgroup regfiBase Base Layer: Essential Functions and Data Structures
[168]839 *
[169]840 * These functions are either necessary for normal use of the regfi API or just
841 * don't fit particularly well in any of the other layers.
[168]842 */
[135]843/******************************************************************************/
[166]844
[168]845/** Parses file headers of an already open registry hive file and
846 *  allocates related structures for further parsing.
[166]847 *
[168]848 * @param fd A file descriptor of an already open file.  Must be seekable.
[166]849 *
[168]850 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
[184]851 *         NULL on error.  Use regfi_free to free the returned REGFI_FILE.
[168]852 *
853 * @ingroup regfiBase
[166]854 */
855REGFI_FILE*           regfi_alloc(int fd);
856
857
[178]858/** Parses file headers returned by supplied callback functions.
[166]859 *
[178]860 * This interface is useful if you have a registry hive in memory
861 * or have some other reason to emulate a real file.
[166]862 *
[178]863 * @param file_cb A structure defining the callback functions needed to access the file.
[168]864 *
[178]865 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
[184]866 *         NULL on error.  Use regfi_free to free the returned REGFI_FILE.
[178]867 *
[168]868 * @ingroup regfiBase
[166]869 */
[178]870REGFI_FILE*           regfi_alloc_cb(REGFI_RAW_FILE* file_cb);
[166]871
872
[168]873/** Frees a hive's data structures without closing the underlying file.
[166]874 *
[168]875 * @param file The registry structure to free.
876 *
877 * @ingroup regfiBase
[166]878 */
879void                  regfi_free(REGFI_FILE* file);
880
881
[168]882/** Get errors, warnings, and/or verbose information relating to processing of
883 *  the given registry file.
[135]884 *
[168]885 * @return A newly allocated char* which must be free()d by the caller.
886 *
887 * @ingroup regfiBase
[135]888 */
[182]889char* regfi_log_get_str();
[159]890
[166]891
[185]892/** Set the verbosity level of messages generated by the library for the
893 *  current thread.
[166]894 *
[185]895 * @param mask   An integer representing the types of messages desired.
[166]896 *               Acceptable values are created through bitwise ORs of
[185]897 *               REGFI_LOG_* values.  For instance, if only errors and
[166]898 *               informational messages were desired (but not warnings),
[185]899 *               then one would specify: REGFI_LOG_ERROR|REGFI_LOG_INFO
900 *               By default the message mask is: REGFI_LOG_ERROR|REGFI_LOG_WARN.
[166]901 *
[185]902 * @return       true on success and false on failure.  Failure occurs if
903 *               underlying pthread functions fail.  errno is set in this case.
[182]904 *
[185]905 * Message masks are set in a thread-specific way.  If one were to set a message
906 * mask in one thread and then spawn a new thread, then the new thread will have
907 * it's message mask reset to the default.  This function may be called at any
908 * time and will take effect immediately for the current thread.
[182]909 *
[185]910 * @note When a non-zero message mask is set, messages will
911 *       accumulate in memory without limit if they are not fetched using
912 *       @ref regfi_get_log_str and subsequently freed by the caller.  It is
913 *       recommended that messsages be fetched after each regfi API call in
914 *       order to provide the most context.
915 *
[182]916 * @ingroup regfiBase
917 */
[185]918bool regfi_log_set_mask(uint16_t mask);
[182]919
920
[168]921/* Dispose of previously parsed records */
922
[184]923/** Frees a record previously returned by one of the API functions.
[159]924 *
[184]925 * Can be used to free REGFI_NK_REC, REGFI_VK_REC, REGFI_SK_REC, REGFI_DATA, and
926 * REGFI_CLASSNAME records.
[159]927 *
[184]928 * @note The "const" in the data type is a bit misleading and is there just for
929 * convenience.  Since records returned previously must not be modified by users
930 * of the API due to internal caching, these are returned as const, so this
931 * function is const to make passing back in easy.
[168]932 *
933 * @ingroup regfiBase
934 */
[184]935void regfi_free_record(const void* record);
[168]936
937
938/******************************************************************************/
939/**
[169]940 * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface
[168]941 *
942 * This top layer of API functions provides an iterator interface which makes
943 * traversing registry data structures easy in both single-threaded and
944 * multi-threaded scenarios.
945 */
946/******************************************************************************/
947
948/** Creates a new iterator for the provided registry file.
949 *
950 * @param file The opened registry file the iterator should be created for.
951 *
952 * @param output_encoding Character encoding that strings should be returned in.
953 *                        Only supply the REGFI_ENCODING_* constants, as others
954 *                        will be rejected.
955 *                        The following values are currently accepted:
956 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
957 *                        REGFI_ENCODING_ASCII
958 *                        REGFI_ENCODING_UTF8
959 *
960 * @return A newly allocated REGFI_ITERATOR.
961 *         Must be free()d with regfi_iterator_free.
962 *
[169]963 * @ingroup regfiIteratorLayer
[168]964 */
[159]965REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* file,
[161]966                                         REGFI_ENCODING output_encoding);
[166]967
968
[168]969/** Frees a registry file iterator previously created by regfi_iterator_new.
[166]970 *
971 * This does not affect the underlying registry file's allocation status.
972 *
[168]973 * @param i the iterator to be freed
974 *
[169]975 * @ingroup regfiIteratorLayer
[166]976 */
[84]977void                  regfi_iterator_free(REGFI_ITERATOR* i);
[166]978
979
[168]980/** Traverse deeper into the registry tree at the current subkey.
[166]981 *
[168]982 * @param i the iterator
[166]983 *
[168]984 * @return  true on success, false on failure. 
985 *          Note that subkey and value indexes are preserved.  That is, if a
986 *          regfi_iterator_up call occurs later (reversing the effect of this
987 *          call) then the subkey and value referenced prior to the
988 *          regfi_iterator_down call will still be referenced.  This  makes
989 *          depth-first iteration particularly easy.
990 *
[169]991 * @ingroup regfiIteratorLayer
[166]992 */
[84]993bool                  regfi_iterator_down(REGFI_ITERATOR* i);
[166]994
995
[168]996/** Traverse up to the current key's parent key.
[166]997 *
[168]998 * @param i the iterator
[166]999 *
[168]1000 * @return  true on success, false on failure.  Any subkey or value state
1001 *          associated with the current key is lost.
1002 *
[169]1003 * @ingroup regfiIteratorLayer
[166]1004 */
[84]1005bool                  regfi_iterator_up(REGFI_ITERATOR* i);
[166]1006
1007
[168]1008/** Traverse up to the root key of the hive.
[166]1009 *
[168]1010 * @param i the iterator
[166]1011 *
[168]1012 * @return true on success, false on failure.
1013 *
[169]1014 * @ingroup regfiIteratorLayer
[166]1015 */
[84]1016bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
[30]1017
[166]1018
[168]1019/** Traverse down multiple levels in the registry hive.
[166]1020 *
1021 * XXX: This currently only accepts ASCII key names.  Need to look into
1022 *      accepting other encodings.
1023 *
[168]1024 * @param i    the iterator
1025 * @param path a list of key names representing the path.  This list must
1026 *             contain NUL terminated strings.  The list itself is
1027 *             terminated with a NULL pointer.  All path elements must be
1028 *             keys; value names are not accepted (even as the last
1029 *             element).
1030 *
1031 * @return true on success, false on failure.  If any element of path is not
1032 *                 found, false will be returned and the iterator will remain
1033 *                 in its original position.
1034 *
[169]1035 * @ingroup regfiIteratorLayer
[166]1036 */
[168]1037bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
[166]1038
1039
[168]1040/** Returns the currently referenced key.
[166]1041 *
[168]1042 * @param i the iterator
[166]1043 *
[168]1044 * @return A read-only key structure for the current key, or NULL on failure.
1045 *
[169]1046 * @ingroup regfiIteratorLayer
[166]1047 */
[184]1048const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
[166]1049
1050
[168]1051/** Returns the SK (security) record referenced by the current key.
[166]1052 *
[168]1053 * @param i the iterator
[166]1054 *
[168]1055 * @return A read-only SK structure, or NULL on failure.
1056 *
[169]1057 * @ingroup regfiIteratorLayer
[166]1058 */
[184]1059const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
[80]1060
[166]1061
[168]1062/** Sets the internal subkey index to the first subkey referenced by the current
1063 *  key and returns that key.
[166]1064 *
[168]1065 * @param i the iterator
[166]1066 *
[168]1067 * @return A newly allocated key structure for the newly referenced first
1068 *         subkey, or NULL on failure.  Failure may be due to a lack of any
1069 *         subkeys or other errors.  Newly allocated keys must be freed with
[185]1070 *         @ref regfi_free_record.
[168]1071 *
[169]1072 * @ingroup regfiIteratorLayer
[166]1073 */
[184]1074const REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
[166]1075
1076
[168]1077/** Returns the currently indexed subkey.
[166]1078 *
[168]1079 * @param i the iterator
[166]1080 *
[168]1081 * @return A newly allocated key structure for the currently referenced subkey,
1082 *         or NULL on failure.  Newly allocated keys must be freed with
[185]1083 *         @ref regfi_free_record.
[168]1084 *
[169]1085 * @ingroup regfiIteratorLayer
[166]1086 */
[184]1087const REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
[167]1088
1089
[168]1090/** Increments the internal subkey index to the next key in the subkey-list and
1091 *  returns the subkey for that index.
[167]1092 *
[168]1093 * @param i the iterator
[167]1094 *
[168]1095 * @return A newly allocated key structure for the next subkey or NULL on
[185]1096 *         failure.  Newly allocated keys must be freed with
1097 *         @ref regfi_free_record.
[168]1098 *
[169]1099 * @ingroup regfiIteratorLayer
[167]1100 */
[184]1101const REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
[167]1102
1103
[168]1104/** Searches for a subkey with a given name under the current key.
[167]1105 *
[168]1106 * @param i           the iterator
1107 * @param subkey_name subkey name to search for
[167]1108 *
[168]1109 * @return True if such a subkey was found, false otherwise.  If a subkey is
1110 *         found, the current subkey index is set to that subkey.  Otherwise,
1111 *         the subkey index remains at the same location as before the call.
1112 *
[169]1113 * @ingroup regfiIteratorLayer
[167]1114 */
[184]1115bool regfi_iterator_find_subkey(REGFI_ITERATOR* i, const char* subkey_name);
[150]1116
[184]1117
[168]1118/** Sets the internal value index to the first value referenced by the current
1119 *  key and returns that value.
[167]1120 *
[168]1121 * @param i the iterator
[167]1122 *
[168]1123 * @return  A newly allocated value structure for the newly referenced first
1124 *          value, or NULL on failure.  Failure may be due to a lack of any
1125 *          values or other errors.  Newly allocated keys must be freed with
[185]1126 *          @ref regfi_free_record.
[168]1127 *
[169]1128 * @ingroup regfiIteratorLayer
[167]1129 */
[184]1130const REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
[167]1131
1132
[168]1133/** Returns the currently indexed value.
[167]1134 *
[168]1135 * @param i the iterator
[167]1136 *
[168]1137 * @return A newly allocated value structure for the currently referenced value,
1138 *         or NULL on failure.  Newly allocated values must be freed with
[185]1139 *         @ref regfi_free_record.
[168]1140 *
[169]1141 * @ingroup regfiIteratorLayer
[167]1142 */
[184]1143const REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
[167]1144
1145
[168]1146/** Increments the internal value index to the next value in the value-list and
1147 *  returns the value for that index.
[167]1148 *
[168]1149 * @param i the iterator
[167]1150 *
[168]1151 * @return  A newly allocated key structure for the next value or NULL on
[185]1152 *          failure.  Newly allocated keys must be freed with
1153 *          @ref regfi_free_record.
[168]1154 *
[169]1155 * @ingroup regfiIteratorLayer
[167]1156 */
[184]1157const REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
[167]1158
1159
[168]1160/** Searches for a value with a given name under the current key.
[167]1161 *
[168]1162 * @param i          the iterator
1163 * @param value_name value name to search for
[167]1164 *
[168]1165 * @return True if such a value was found, false otherwise.  If a value is
1166 *         found, the current value index is set to that value.  Otherwise,
1167 *         the value index remains at the same location as before the call.
1168 *
[169]1169 * @ingroup regfiIteratorLayer
[167]1170 */
[157]1171bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
1172                                                const char* value_name);
[80]1173
[168]1174/** Retrieves classname for a given key.
[167]1175 *
[168]1176 * @param i   the iterator
1177 * @param key the key whose classname is desired
[167]1178 *
[168]1179 * @return Returns a newly allocated classname structure, or NULL on failure.
[185]1180 *         Classname structures must be freed with @ref regfi_free_record.
[168]1181 *
[169]1182 * @ingroup regfiIteratorLayer
[167]1183 */
[184]1184const REGFI_CLASSNAME* regfi_iterator_fetch_classname(REGFI_ITERATOR* i, 
1185                                                      const REGFI_NK_REC* key);
[167]1186
1187
[168]1188/** Retrieves data for a given value.
[167]1189 *
[168]1190 * @param i     the iterator
1191 * @param value the value whose data is desired
[167]1192 *
[168]1193 * @return Returns a newly allocated data structure, or NULL on failure.
[185]1194 *         Data structures must be freed with @ref regfi_free_record.
[168]1195 *
[169]1196 * @ingroup regfiIteratorLayer
[167]1197 */
[184]1198const REGFI_DATA* regfi_iterator_fetch_data(REGFI_ITERATOR* i,
1199                                            const REGFI_VK_REC* value);
[127]1200
[157]1201
[168]1202
1203/******************************************************************************/
1204/**
[169]1205 * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading
[168]1206 */
1207/******************************************************************************/
1208
1209/** Loads a key at a given file offset along with associated data structures.
1210 *
1211 * XXX: finish documenting
1212 *
[169]1213 * @ingroup regfiGlueLayer
[168]1214 */
1215REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32_t offset, 
[161]1216                                     REGFI_ENCODING output_encoding, 
[135]1217                                     bool strict);
[168]1218
1219
1220/** Loads a value at a given file offset alng with associated data structures.
1221 *
1222 * XXX: finish documenting
1223 *
[169]1224 * @ingroup regfiGlueLayer
[168]1225 */
1226REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32_t offset, 
[162]1227                                       REGFI_ENCODING output_encoding, 
[145]1228                                       bool strict);
[168]1229
1230
1231/** Loads a logical subkey list in its entirety which may span multiple records.
1232 *
1233 * XXX: finish documenting
1234 *
[169]1235 * @ingroup regfiGlueLayer
[168]1236 */
1237REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
1238                                            uint32_t num_keys, uint32_t max_size,
[146]1239                                            bool strict);
[168]1240
1241
1242/** Loads a valuelist.
1243 *
1244 * XXX: finish documenting
1245 *
[169]1246 * @ingroup regfiGlueLayer
[168]1247 */
1248REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, 
1249                                           uint32_t num_values, uint32_t max_size,
[135]1250                                           bool strict);
[127]1251
[168]1252
1253/** Loads a data record which may be contained in the virtual offset, in a
1254 *  single cell, or in multiple cells through big data records.
1255 *
1256 * XXX: finish documenting
1257 *
[169]1258 * @ingroup regfiGlueLayer
[168]1259 */
1260REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32_t voffset,
1261                                      uint32_t length, bool data_in_offset,
[157]1262                                      bool strict);
1263
[168]1264
1265/** Loads the data associated with a big data record at the specified offset.
1266 *
1267 * XXX: finish documenting
1268 *
[169]1269 * @ingroup regfiGlueLayer
[168]1270 */
1271REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32_t offset, 
1272                                          uint32_t data_length,uint32_t cell_length,
[157]1273                                          range_list* used_ranges,
1274                                          bool strict);
[168]1275
1276
1277/** Given raw data, attempts to interpret the data based on a specified registry
1278 *  data type.
1279 *
1280 * XXX: finish documenting
1281 *
[169]1282 * @ingroup regfiGlueLayer
[168]1283 */
[159]1284bool                  regfi_interpret_data(REGFI_FILE* file, 
[161]1285                                           REGFI_ENCODING string_encoding,
[168]1286                                           uint32_t type, REGFI_DATA* data);
1287
1288
1289
[146]1290/* These are cached so return values don't need to be freed. */
[168]1291
1292/** Loads an "sk" security record at the specified offset.
1293 *
1294 * XXX: finish documenting
1295 *
[169]1296 * @ingroup regfiGlueLayer
[168]1297 */
1298const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32_t offset,
[146]1299                                    bool strict);
1300
1301
[168]1302/** Retrieves the HBIN data structure stored at the specified offset.
1303 *
1304 * XXX: finish documenting
1305 *
[169]1306 * @ingroup regfiGlueLayer
[168]1307 */
1308const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
1309
1310
1311
1312/******************************************************************************/
1313/**
[169]1314 * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access
[168]1315 */
1316/******************************************************************************/
1317
[178]1318REGFI_FILE*           regfi_parse_regf(REGFI_RAW_FILE* file_cb, bool strict);
[168]1319REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, 
[110]1320                                       bool strict);
[80]1321
[99]1322
[168]1323/** Parses an NK record at the specified offset
[99]1324 *
[168]1325 * @param file     the registry file structure
1326 * @param offset   the offset of the cell (not the record) to be parsed.
1327 * @param max_size the maximum size the NK cell could be. (for validation)
1328 * @param strict   if true, rejects any malformed records.  Otherwise,
1329 *                 tries to minimally validate integrity.
1330 *
1331 * @return A newly allocated NK record structure, or NULL on failure.
1332 *
[169]1333 * @ingroup regfiParseLayer
[99]1334 */
[168]1335REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
1336                                     uint32_t max_size, bool strict);
[99]1337
[139]1338
[168]1339/** Parses a single cell containing a subkey-list record.
1340 *
1341 * XXX: finish documenting
1342 *
[169]1343 * @ingroup regfiParseLayer
[168]1344 */
1345REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
1346                                             uint32_t max_size, bool strict);
[103]1347
[111]1348
[168]1349/** Parses a VK (value) record at the specified offset
1350 *
1351 * XXX: finish documenting
1352 *
[169]1353 * @ingroup regfiParseLayer
[168]1354 */
1355REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32_t offset, 
1356                                     uint32_t max_size, bool strict);
1357
1358
1359/** Parses an SK (security) record at the specified offset
1360 *
1361 * XXX: finish documenting
1362 *
[169]1363 * @ingroup regfiParseLayer
[168]1364 */
1365REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32_t offset, 
1366                                     uint32_t max_size, bool strict);
1367
1368
1369/** Retrieves information on all cells in the registry hive which are
1370 *  currently in the unallocated status. 
1371 *
1372 * The unallocated status is determined based soley on the cell length sign.
1373 *
1374 * XXX: finish documenting
1375 *
[169]1376 * @ingroup regfiParseLayer
[168]1377 */
[135]1378range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
[101]1379
[111]1380
[168]1381/** Helper function to parse a cell
1382 *
1383 * XXX: finish documenting
1384 *
[169]1385 * @ingroup regfiParseLayer
[168]1386 */
[178]1387bool                  regfi_parse_cell(REGFI_RAW_FILE* file_cb, uint32_t offset,
[168]1388                                       uint8_t* hdr, uint32_t hdr_len,
1389                                       uint32_t* cell_length, bool* unalloc);
[126]1390
[157]1391
[168]1392/** Parses a classname cell
1393 *
1394 * XXX: finish documenting
1395 *
[169]1396 * @ingroup regfiParseLayer
[168]1397 */
1398uint8_t*                regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
1399                                            uint16_t* name_length, 
1400                                            uint32_t max_size, bool strict);
[157]1401
1402
[168]1403/** Parses a single-cell data record
1404 *
1405 * XXX: finish documenting
1406 *
[169]1407 * @ingroup regfiParseLayer
[168]1408 */
1409REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32_t offset,
1410                                       uint32_t length, bool strict);
[127]1411
[150]1412
[168]1413/** Parses a "little data" record which is stored entirely within the
1414 *  provided virtual offset.
1415 *
1416 * XXX: finish documenting
1417 *
[169]1418 * @ingroup regfiParseLayer
[168]1419 */
1420REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, 
1421                                              uint32_t length, bool strict);
[150]1422
[168]1423
1424/******************************************************************************/
1425/*    Private Functions                                                       */
1426/******************************************************************************/
[161]1427REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file, 
1428                                    REGFI_ENCODING output_encoding);
[127]1429
[178]1430off_t                 regfi_raw_seek(REGFI_RAW_FILE* self, 
1431                                     off_t offset, int whence);
1432ssize_t               regfi_raw_read(REGFI_RAW_FILE* self, 
1433                                     void* buf, size_t count);
1434off_t                 regfi_seek(REGFI_RAW_FILE* file_cb, 
1435                                 off_t offset, int whence);
1436uint32_t              regfi_read(REGFI_RAW_FILE* file_cb, 
1437                                 uint8_t* buf, uint32_t* length);
1438
[135]1439const char*           regfi_type_val2str(unsigned int val);
1440int                   regfi_type_str2val(const char* str);
[127]1441
[135]1442char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
1443char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
1444char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
1445char*                 regfi_get_group(WINSEC_DESC* sec_desc);
1446
[168]1447REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists, 
[135]1448                                              REGFI_SUBKEY_LIST** lists,
1449                                              bool strict);
[168]1450REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1451                                                uint32_t max_size, bool strict,
1452                                                uint8_t depth_left);
1453void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type, 
[138]1454                                        const char* fmt, ...);
[146]1455REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
1456REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
[168]1457int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1458int32_t               regfi_conv_charset(const char* input_charset, 
[161]1459                                         const char* output_charset,
[168]1460                                         uint8_t* input, char* output, 
1461                                         uint32_t input_len, uint32_t output_max);
[159]1462REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
[146]1463
[168]1464/* XXX: move to base API and document */
1465void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
1466time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
1467
1468
[172]1469void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk, 
1470                             REGFI_ENCODING output_encoding, bool strict);
1471void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk, 
1472                               REGFI_ENCODING output_encoding, bool strict);
1473
1474
[78]1475#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.