[169] | 1 | /* |
---|
[168] | 2 | * Copyright (C) 2005-2010 Timothy D. Morgan |
---|
[193] | 3 | * Copyright (C) 2010 Michael Cohen |
---|
[30] | 4 | * Copyright (C) 2005 Gerald (Jerry) Carter |
---|
| 5 | * |
---|
| 6 | * This program is free software; you can redistribute it and/or modify |
---|
| 7 | * it under the terms of the GNU General Public License as published by |
---|
[134] | 8 | * the Free Software Foundation; version 3 of the License. |
---|
[30] | 9 | * |
---|
| 10 | * This program is distributed in the hope that it will be useful, |
---|
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 13 | * GNU General Public License for more details. |
---|
| 14 | * |
---|
| 15 | * You should have received a copy of the GNU General Public License |
---|
| 16 | * along with this program; if not, write to the Free Software |
---|
| 17 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
| 18 | * |
---|
| 19 | * $Id: regfi.h 252 2011-05-08 17:33:49Z tim $ |
---|
| 20 | */ |
---|
| 21 | |
---|
[169] | 22 | /** |
---|
| 23 | * @file |
---|
| 24 | * Windows NT (and later) read-only registry library |
---|
| 25 | * |
---|
| 26 | * This library is intended for use in digital forensics investigations, but |
---|
| 27 | * is likely useful in other applications. |
---|
| 28 | * |
---|
| 29 | * Branched from Samba project Subversion repository, version #6903: |
---|
| 30 | * http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto |
---|
| 31 | * |
---|
| 32 | * Since then, it has been heavily rewritten, simplified, and improved. |
---|
| 33 | */ |
---|
[30] | 34 | |
---|
[168] | 35 | /** |
---|
| 36 | * @mainpage Home |
---|
| 37 | * |
---|
[169] | 38 | * The regfi library is a read-only NT registry library which serves as the main |
---|
| 39 | * engine behind the reglookup tool. It is designed with digital forensic |
---|
| 40 | * analysis in mind, but it should also be useful in other tools which need to |
---|
| 41 | * efficiently traverse and query registry data structures. |
---|
| 42 | * |
---|
| 43 | * The library is broken down into four main parts, the |
---|
| 44 | * @ref regfiBase "Base Layer", which any code dependent on the library will |
---|
| 45 | * likely need to rely on, as well as three main functional layers: |
---|
| 46 | * @li @ref regfiIteratorLayer |
---|
| 47 | * @li @ref regfiGlueLayer |
---|
| 48 | * @li @ref regfiParseLayer |
---|
| 49 | * |
---|
| 50 | * Most users will find that a combination of the Base Layer and the Iterator Layer |
---|
[185] | 51 | * will be sufficient for accessing registry hive files. Those who are willing |
---|
[169] | 52 | * to dive deep into registry data structures, for instance to recover deleted |
---|
| 53 | * data structures or to research Windows registry behavior in detail, will |
---|
| 54 | * find the Parse Layer to be quite useful. |
---|
[168] | 55 | */ |
---|
| 56 | |
---|
[169] | 57 | |
---|
[78] | 58 | #ifndef _REGFI_H |
---|
| 59 | #define _REGFI_H |
---|
[30] | 60 | |
---|
[31] | 61 | #include <stdlib.h> |
---|
| 62 | #include <stdio.h> |
---|
[30] | 63 | #include <stdbool.h> |
---|
[31] | 64 | #include <string.h> |
---|
[30] | 65 | #include <errno.h> |
---|
[31] | 66 | #include <time.h> |
---|
[30] | 67 | #include <fcntl.h> |
---|
| 68 | #include <sys/stat.h> |
---|
| 69 | #include <sys/types.h> |
---|
| 70 | #include <unistd.h> |
---|
[159] | 71 | #include <iconv.h> |
---|
[180] | 72 | #include <pthread.h> |
---|
[201] | 73 | #include <talloc.h> |
---|
[30] | 74 | |
---|
[193] | 75 | /* regfi headers */ |
---|
| 76 | #include <byteorder.h> |
---|
| 77 | #include <winsec.h> |
---|
| 78 | #include <void_stack.h> |
---|
| 79 | #include <range_list.h> |
---|
| 80 | #include <lru_cache.h> |
---|
[30] | 81 | |
---|
[201] | 82 | /* GCC-specific macro for library exports */ |
---|
| 83 | #ifdef _EXPORT |
---|
| 84 | #undef _EXPORT |
---|
| 85 | #endif |
---|
[226] | 86 | #ifdef REGFI_WIN32 |
---|
[238] | 87 | #define _EXPORT() __declspec(dllexport) |
---|
[226] | 88 | #else |
---|
[238] | 89 | #define _EXPORT() __attribute__((visibility("default"))) |
---|
[226] | 90 | #endif |
---|
[184] | 91 | |
---|
[226] | 92 | #ifndef EOVERFLOW |
---|
| 93 | # define EOVERFLOW E2BIG |
---|
| 94 | #endif |
---|
[185] | 95 | |
---|
[30] | 96 | /******************************************************************************/ |
---|
[184] | 97 | /* Constants for use while interacting with the library */ |
---|
| 98 | /******************************************************************************/ |
---|
[138] | 99 | |
---|
| 100 | /* regfi library error message types */ |
---|
[182] | 101 | #define REGFI_LOG_INFO 0x0001 |
---|
| 102 | #define REGFI_LOG_WARN 0x0004 |
---|
| 103 | #define REGFI_LOG_ERROR 0x0010 |
---|
[185] | 104 | #define REGFI_DEFAULT_LOG_MASK REGFI_LOG_ERROR|REGFI_LOG_WARN |
---|
[138] | 105 | |
---|
[161] | 106 | /* regfi library supported character encodings */ |
---|
| 107 | /* UTF16LE is not supported for output */ |
---|
[193] | 108 | typedef enum { |
---|
| 109 | REGFI_ENCODING_DEFAULT = 0, |
---|
| 110 | REGFI_ENCODING_ASCII = 0, |
---|
| 111 | REGFI_ENCODING_UTF8 = 1, |
---|
| 112 | REGFI_ENCODING_UTF16LE = 2, |
---|
| 113 | REGFI_NUM_ENCODINGS = 3 |
---|
| 114 | } REGFI_ENCODING; |
---|
[161] | 115 | |
---|
[32] | 116 | /* Registry data types */ |
---|
[193] | 117 | typedef enum { |
---|
| 118 | REG_NONE = 0, |
---|
| 119 | REG_SZ = 1, |
---|
| 120 | REG_EXPAND_SZ = 2, |
---|
| 121 | REG_BINARY = 3, |
---|
| 122 | REG_DWORD = 4, |
---|
| 123 | REG_DWORD_LE = 4 , /* DWORD, little endian */ |
---|
| 124 | REG_DWORD_BE = 5 , /* DWORD, big endian */ |
---|
| 125 | REG_LINK = 6, |
---|
| 126 | REG_MULTI_SZ = 7, |
---|
| 127 | REG_RESOURCE_LIST = 8, |
---|
| 128 | REG_FULL_RESOURCE_DESCRIPTOR= 9, |
---|
| 129 | REG_RESOURCE_REQUIREMENTS_LIST= 10, |
---|
| 130 | REG_QWORD = 11, /* 64-bit little endian */ |
---|
[72] | 131 | /* XXX: Has MS defined a REG_QWORD_BE? */ |
---|
[32] | 132 | /* Not a real type in the registry */ |
---|
[193] | 133 | REG_KEY = 0x7FFFFFFF |
---|
| 134 | } REGFI_DATA_TYPE; |
---|
[135] | 135 | #define REGFI_OFFSET_NONE 0xffffffff |
---|
[30] | 136 | |
---|
[165] | 137 | |
---|
[184] | 138 | |
---|
| 139 | /******************************************************************************/ |
---|
| 140 | /* Various resource limits and related constants */ |
---|
| 141 | /******************************************************************************/ |
---|
| 142 | |
---|
[250] | 143 | /* Flags determining how many records to cache internally */ |
---|
| 144 | #define REGFI_CACHE_SK_MAX 64 |
---|
| 145 | #define REGFI_CACHE_NK_MAX 1024 |
---|
[184] | 146 | |
---|
[165] | 147 | /* This maximum depth is described here: |
---|
| 148 | * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx |
---|
| 149 | */ |
---|
| 150 | #define REGFI_MAX_DEPTH 512 |
---|
| 151 | |
---|
| 152 | /* This limit defines the maximum number of levels deep that ri subkey list |
---|
| 153 | * trees can go. |
---|
| 154 | */ |
---|
| 155 | /* XXX: This is totally arbitrary right now. |
---|
| 156 | * The actual limit may need to be discovered by experimentation. |
---|
| 157 | */ |
---|
[149] | 158 | #define REGFI_MAX_SUBKEY_DEPTH 255 |
---|
[139] | 159 | |
---|
[165] | 160 | |
---|
[184] | 161 | /******************************************************************************/ |
---|
| 162 | /* Symbols for internal use */ |
---|
| 163 | /******************************************************************************/ |
---|
| 164 | |
---|
| 165 | /* Global thread-local storage key */ |
---|
[185] | 166 | pthread_key_t regfi_log_key; |
---|
[184] | 167 | |
---|
[135] | 168 | /* Header sizes and magic number lengths for various records */ |
---|
[147] | 169 | #define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */ |
---|
| 170 | #define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */ |
---|
[135] | 171 | #define REGFI_REGF_MAGIC_SIZE 4 |
---|
[151] | 172 | #define REGFI_REGF_NAME_SIZE 64 |
---|
| 173 | #define REGFI_REGF_RESERVED1_SIZE 340 |
---|
| 174 | #define REGFI_REGF_RESERVED2_SIZE 3528 |
---|
[135] | 175 | #define REGFI_HBIN_MAGIC_SIZE 4 |
---|
| 176 | #define REGFI_CELL_MAGIC_SIZE 2 |
---|
| 177 | #define REGFI_HBIN_HEADER_SIZE 0x20 |
---|
[116] | 178 | #define REGFI_NK_MIN_LENGTH 0x4C |
---|
| 179 | #define REGFI_VK_MIN_LENGTH 0x14 |
---|
| 180 | #define REGFI_SK_MIN_LENGTH 0x14 |
---|
[127] | 181 | #define REGFI_SUBKEY_LIST_MIN_LEN 0x4 |
---|
[157] | 182 | #define REGFI_BIG_DATA_MIN_LENGTH 0xC |
---|
[30] | 183 | |
---|
[135] | 184 | |
---|
[116] | 185 | /* Constants used for validation */ |
---|
[125] | 186 | /* XXX: Can we add clock resolution validation as well as range? It has |
---|
| 187 | * been reported that Windows timestamps are never more than a |
---|
| 188 | * certain granularity (250ms?), which could be used to help |
---|
[147] | 189 | * eliminate false positives. Would need to verify this and |
---|
[125] | 190 | * perhaps conservatively implement a check. |
---|
| 191 | */ |
---|
[116] | 192 | /* Minimum time is Jan 1, 1990 00:00:00 */ |
---|
[251] | 193 | #define REGFI_MTIME_MIN 0x01B41E6D00000000L |
---|
[178] | 194 | |
---|
[116] | 195 | /* Maximum time is Jan 1, 2290 00:00:00 |
---|
| 196 | * (We hope no one is using Windows by then...) |
---|
| 197 | */ |
---|
[251] | 198 | #define REGFI_MTIME_MAX 0x0304754300000000L |
---|
[30] | 199 | |
---|
[116] | 200 | |
---|
[30] | 201 | /* Flags for the vk records */ |
---|
[162] | 202 | #define REGFI_VK_FLAG_ASCIINAME 0x0001 |
---|
[135] | 203 | #define REGFI_VK_DATA_IN_OFFSET 0x80000000 |
---|
[152] | 204 | #define REGFI_VK_MAX_DATA_LENGTH 1024*1024 /* XXX: This is arbitrary */ |
---|
[30] | 205 | |
---|
[137] | 206 | |
---|
[152] | 207 | /* Known key flags */ |
---|
| 208 | /*******************/ |
---|
[137] | 209 | /* These next two show up on normal-seeming keys in Vista and W2K3 registries */ |
---|
| 210 | #define REGFI_NK_FLAG_UNKNOWN1 0x4000 |
---|
| 211 | #define REGFI_NK_FLAG_UNKNOWN2 0x1000 |
---|
[152] | 212 | |
---|
[167] | 213 | /* This next one shows up in some Vista "software" registries */ |
---|
| 214 | /* XXX: This shows up in the following two SOFTWARE keys in Vista: |
---|
| 215 | * /Wow6432Node/Microsoft |
---|
| 216 | * /Wow6432Node/Microsoft/Cryptography |
---|
| 217 | * |
---|
| 218 | * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0 |
---|
| 219 | */ |
---|
[137] | 220 | #define REGFI_NK_FLAG_UNKNOWN3 0x0080 |
---|
[30] | 221 | |
---|
[152] | 222 | /* Predefined handle. Rumor has it that the valuelist count for this key is |
---|
| 223 | * where the handle is stored. |
---|
| 224 | * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx |
---|
| 225 | */ |
---|
| 226 | #define REGFI_NK_FLAG_PREDEF_KEY 0x0040 |
---|
[137] | 227 | |
---|
[152] | 228 | /* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */ |
---|
| 229 | #define REGFI_NK_FLAG_ASCIINAME 0x0020 |
---|
| 230 | |
---|
| 231 | /* Symlink key. |
---|
| 232 | * See: http://www.codeproject.com/KB/system/regsymlink.aspx |
---|
| 233 | */ |
---|
| 234 | #define REGFI_NK_FLAG_LINK 0x0010 |
---|
| 235 | |
---|
| 236 | /* This key cannot be deleted */ |
---|
| 237 | #define REGFI_NK_FLAG_NO_RM 0x0008 |
---|
| 238 | |
---|
| 239 | /* Root of a hive */ |
---|
| 240 | #define REGFI_NK_FLAG_ROOT 0x0004 |
---|
| 241 | |
---|
| 242 | /* Mount point of another hive. NULL/(default) value indicates which hive |
---|
| 243 | * and where in the hive it points to. |
---|
| 244 | */ |
---|
| 245 | #define REGFI_NK_FLAG_HIVE_LINK 0x0002 |
---|
| 246 | |
---|
| 247 | /* These keys shouldn't be stored on disk, according to: |
---|
| 248 | * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx |
---|
| 249 | */ |
---|
| 250 | #define REGFI_NK_FLAG_VOLATILE 0x0001 |
---|
| 251 | |
---|
| 252 | /* Useful for identifying unknown flag types */ |
---|
| 253 | #define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\ |
---|
| 254 | | REGFI_NK_FLAG_ASCIINAME\ |
---|
| 255 | | REGFI_NK_FLAG_LINK\ |
---|
| 256 | | REGFI_NK_FLAG_NO_RM\ |
---|
| 257 | | REGFI_NK_FLAG_ROOT\ |
---|
| 258 | | REGFI_NK_FLAG_HIVE_LINK\ |
---|
| 259 | | REGFI_NK_FLAG_VOLATILE\ |
---|
| 260 | | REGFI_NK_FLAG_UNKNOWN1\ |
---|
[167] | 261 | | REGFI_NK_FLAG_UNKNOWN2\ |
---|
| 262 | | REGFI_NK_FLAG_UNKNOWN3) |
---|
[152] | 263 | |
---|
[168] | 264 | |
---|
[193] | 265 | #ifndef CHAR_BIT |
---|
[168] | 266 | #define CHAR_BIT 8 |
---|
[193] | 267 | #endif |
---|
| 268 | |
---|
[168] | 269 | #define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \ |
---|
| 270 | : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1)) |
---|
| 271 | #define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN) |
---|
[251] | 272 | #define REGFI_TIME_FIXUP (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60)) |
---|
[168] | 273 | |
---|
[184] | 274 | |
---|
| 275 | |
---|
| 276 | /******************************************************************************/ |
---|
| 277 | /* Structures */ |
---|
| 278 | /******************************************************************************/ |
---|
| 279 | |
---|
[251] | 280 | typedef uint64_t REGFI_NTTIME; |
---|
[168] | 281 | |
---|
[182] | 282 | typedef struct _regfi_log |
---|
| 283 | { |
---|
| 284 | /* Error/warning/info messages returned by lower layer functions */ |
---|
| 285 | char* messages; |
---|
| 286 | |
---|
| 287 | /* Mask for error message types that will be stored. */ |
---|
| 288 | uint16_t msg_mask; |
---|
| 289 | |
---|
| 290 | } REGFI_LOG; |
---|
| 291 | |
---|
| 292 | |
---|
[169] | 293 | /** HBIN block information |
---|
| 294 | * @ingroup regfiMiddleLayer |
---|
| 295 | */ |
---|
[135] | 296 | typedef struct _regfi_hbin |
---|
[97] | 297 | { |
---|
[169] | 298 | /** Offset of this HBIN in the registry file */ |
---|
| 299 | uint32_t file_off; |
---|
[97] | 300 | |
---|
[169] | 301 | /** Number of active records pointing to this block (not used currently) */ |
---|
| 302 | uint32_t ref_count; |
---|
| 303 | |
---|
| 304 | /** Offset from first hbin block */ |
---|
| 305 | uint32_t first_hbin_off; |
---|
| 306 | |
---|
| 307 | /** Block size of this block Should be a multiple of 4096 (0x1000) */ |
---|
| 308 | uint32_t block_size; |
---|
| 309 | |
---|
| 310 | /** Relative offset to next block. |
---|
| 311 | * |
---|
| 312 | * @note This value may be unreliable! |
---|
| 313 | */ |
---|
| 314 | uint32_t next_block; |
---|
| 315 | |
---|
| 316 | /** Magic number for the HBIN (should be "hbin"). */ |
---|
| 317 | uint8_t magic[REGFI_HBIN_MAGIC_SIZE]; |
---|
[135] | 318 | } REGFI_HBIN; |
---|
[30] | 319 | |
---|
[97] | 320 | |
---|
[127] | 321 | /* Subkey List -- list of key offsets and hashed names for consistency */ |
---|
[97] | 322 | typedef struct |
---|
| 323 | { |
---|
[139] | 324 | /* Virtual offset of NK record or additional subkey list, |
---|
| 325 | * depending on this list's type. |
---|
| 326 | */ |
---|
[168] | 327 | uint32_t offset; |
---|
[139] | 328 | |
---|
[168] | 329 | uint32_t hash; |
---|
[135] | 330 | } REGFI_SUBKEY_LIST_ELEM; |
---|
[30] | 331 | |
---|
[97] | 332 | |
---|
[169] | 333 | /** Subkey-list structure |
---|
| 334 | * @ingroup regfiMiddleLayer |
---|
| 335 | */ |
---|
[145] | 336 | typedef struct _regfi_subkey_list |
---|
[97] | 337 | { |
---|
[139] | 338 | /* Real offset of this record's cell in the file */ |
---|
[168] | 339 | uint32_t offset; |
---|
[139] | 340 | |
---|
[168] | 341 | uint32_t cell_size; |
---|
[139] | 342 | |
---|
| 343 | /* Number of immediate children */ |
---|
[202] | 344 | uint32_t num_children; |
---|
[139] | 345 | |
---|
[202] | 346 | /* Total number of keys referenced by this list and its children */ |
---|
| 347 | uint32_t num_keys; |
---|
[139] | 348 | |
---|
[135] | 349 | REGFI_SUBKEY_LIST_ELEM* elements; |
---|
[168] | 350 | uint8_t magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[139] | 351 | |
---|
| 352 | /* Set if the magic indicates this subkey list points to child subkey lists */ |
---|
[202] | 353 | bool recursive_type; |
---|
[135] | 354 | } REGFI_SUBKEY_LIST; |
---|
[30] | 355 | |
---|
[97] | 356 | |
---|
[168] | 357 | typedef uint32_t REGFI_VALUE_LIST_ELEM; |
---|
[169] | 358 | /** Value-list structure |
---|
| 359 | * @ingroup regfiMiddleLayer |
---|
| 360 | */ |
---|
[145] | 361 | typedef struct _regfi_value_list |
---|
| 362 | { |
---|
[206] | 363 | /* Real offset of this record's cell in the file */ |
---|
| 364 | uint32_t offset; |
---|
| 365 | |
---|
| 366 | uint32_t cell_size; |
---|
| 367 | |
---|
[145] | 368 | /* Actual number of values referenced by this list. |
---|
| 369 | * May differ from parent key's num_values if there were parsing errors. |
---|
| 370 | */ |
---|
[168] | 371 | uint32_t num_values; |
---|
[145] | 372 | |
---|
| 373 | REGFI_VALUE_LIST_ELEM* elements; |
---|
| 374 | } REGFI_VALUE_LIST; |
---|
| 375 | |
---|
| 376 | |
---|
[169] | 377 | /** Class name structure (used in storing SysKeys) |
---|
| 378 | * @ingroup regfiBase |
---|
| 379 | */ |
---|
[160] | 380 | typedef struct _regfi_classname |
---|
| 381 | { |
---|
[206] | 382 | /** Real offset of this record's cell in the file */ |
---|
| 383 | uint32_t offset; |
---|
| 384 | |
---|
[169] | 385 | /** As converted to requested REGFI_ENCODING */ |
---|
[160] | 386 | char* interpreted; |
---|
| 387 | |
---|
[169] | 388 | /** Represents raw buffer read from classname cell. |
---|
| 389 | * |
---|
| 390 | * Length of this item is specified in the size field. |
---|
| 391 | */ |
---|
[168] | 392 | uint8_t* raw; |
---|
[160] | 393 | |
---|
[169] | 394 | /** Length of the raw data. |
---|
| 395 | * |
---|
| 396 | * May be shorter than that indicated by parent key. |
---|
| 397 | */ |
---|
[168] | 398 | uint16_t size; |
---|
[160] | 399 | } REGFI_CLASSNAME; |
---|
| 400 | |
---|
| 401 | |
---|
[169] | 402 | /** Data record structure |
---|
| 403 | * @ingroup regfiBase |
---|
| 404 | */ |
---|
[159] | 405 | typedef struct _regfi_data |
---|
| 406 | { |
---|
[209] | 407 | /* XXX: this isn't populated yet. Should set it to start of data cell |
---|
| 408 | * or big data cell. |
---|
| 409 | */ |
---|
| 410 | uint32_t offset; |
---|
| 411 | |
---|
[169] | 412 | /** Data type of this data, as indicated by the referencing VK record. */ |
---|
[193] | 413 | REGFI_DATA_TYPE type; |
---|
[159] | 414 | |
---|
[169] | 415 | /** Length of the raw data. */ |
---|
[168] | 416 | uint32_t size; |
---|
[159] | 417 | |
---|
[169] | 418 | /** This is always present, representing the raw data cell contents. */ |
---|
[168] | 419 | uint8_t* raw; |
---|
[159] | 420 | |
---|
[209] | 421 | /** Represents the length of the interpreted value. Meaning is type-specific. |
---|
| 422 | * Will be 0 if interpretation failed for any reason. |
---|
| 423 | */ |
---|
[168] | 424 | uint32_t interpreted_size; |
---|
[159] | 425 | |
---|
[169] | 426 | /** These items represent interpreted versions of the REGFI_DATA::raw field. |
---|
| 427 | * |
---|
| 428 | * Only use the appropriate member according to the REGFI_DATA::type field. |
---|
| 429 | * In the event of an unknown type, use only the REGFI_DATA::raw field. |
---|
[159] | 430 | */ |
---|
| 431 | union _regfi_data_interpreted |
---|
| 432 | { |
---|
[169] | 433 | /** REG_NONE |
---|
| 434 | * |
---|
| 435 | * Stored as a raw buffer. Use REGFI_DATA::interpreted_size to determine |
---|
| 436 | * length. |
---|
| 437 | */ |
---|
| 438 | uint8_t* none; |
---|
| 439 | |
---|
| 440 | /** REG_SZ |
---|
| 441 | * |
---|
| 442 | * Stored as a NUL terminated string. Converted to the specified |
---|
| 443 | * REGFI_ENCODING. |
---|
| 444 | */ |
---|
[168] | 445 | uint8_t* string; |
---|
[169] | 446 | |
---|
| 447 | /** REG_EXPAND_SZ |
---|
| 448 | * |
---|
| 449 | * Stored as a NUL terminated string. Converted to the specified |
---|
| 450 | * REGFI_ENCODING. |
---|
| 451 | */ |
---|
[168] | 452 | uint8_t* expand_string; |
---|
[169] | 453 | |
---|
| 454 | /** REG_BINARY |
---|
| 455 | * |
---|
| 456 | * Stored as a raw buffer. Use REGFI_DATA::interpreted_size to determine |
---|
| 457 | * length. |
---|
| 458 | */ |
---|
| 459 | uint8_t* binary; |
---|
| 460 | |
---|
| 461 | /** REG_DWORD */ |
---|
[168] | 462 | uint32_t dword; |
---|
[169] | 463 | |
---|
| 464 | /** REG_DWORD_BE */ |
---|
[168] | 465 | uint32_t dword_be; |
---|
[169] | 466 | |
---|
| 467 | /** REG_LINK |
---|
| 468 | * |
---|
| 469 | * Stored as a NUL terminated string. Converted to the specified |
---|
| 470 | * REGFI_ENCODING. |
---|
| 471 | */ |
---|
[168] | 472 | uint8_t* link; |
---|
[169] | 473 | |
---|
| 474 | /** REG_MULTI_SZ |
---|
| 475 | * |
---|
| 476 | * Stored as a list of uint8_t* pointers, terminated with a NULL pointer. |
---|
| 477 | * Each string element in the list is NUL terminated, and the character set |
---|
| 478 | * is determined by the specified REGFI_ENCODING. |
---|
| 479 | */ |
---|
[168] | 480 | uint8_t** multiple_string; |
---|
[169] | 481 | |
---|
| 482 | /** REG_QWORD */ |
---|
[168] | 483 | uint64_t qword; |
---|
[159] | 484 | |
---|
| 485 | /* The following are treated as binary currently, but this may change in |
---|
| 486 | * the future as the formats become better understood. |
---|
| 487 | */ |
---|
[169] | 488 | |
---|
| 489 | /** REG_RESOURCE_LIST |
---|
| 490 | * |
---|
| 491 | * Stored as a raw buffer. Use REGFI_DATA::interpreted_size to determine |
---|
| 492 | * length. |
---|
| 493 | */ |
---|
[168] | 494 | uint8_t* resource_list; |
---|
[169] | 495 | |
---|
| 496 | /** REG_FULL_RESOURCE_DESCRIPTOR |
---|
| 497 | * |
---|
| 498 | * Stored as a raw buffer. Use REGFI_DATA::interpreted_size to determine |
---|
| 499 | * length. |
---|
| 500 | */ |
---|
[168] | 501 | uint8_t* full_resource_descriptor; |
---|
[169] | 502 | |
---|
| 503 | /** REG_RESOURCE_REQUIREMENTS_LIST |
---|
| 504 | * |
---|
| 505 | * Stored as a raw buffer. Use REGFI_DATA::interpreted_size to determine |
---|
| 506 | * length. |
---|
| 507 | */ |
---|
[168] | 508 | uint8_t* resource_requirements_list; |
---|
[159] | 509 | } interpreted; |
---|
| 510 | } REGFI_DATA; |
---|
| 511 | |
---|
| 512 | |
---|
[169] | 513 | /** Value structure |
---|
| 514 | * @ingroup regfiBase |
---|
| 515 | */ |
---|
[206] | 516 | typedef struct _regfi_vk |
---|
[97] | 517 | { |
---|
[169] | 518 | /** Real offset of this record's cell in the file */ |
---|
| 519 | uint32_t offset; |
---|
[101] | 520 | |
---|
[169] | 521 | /** ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 522 | uint32_t cell_size; |
---|
[159] | 523 | |
---|
[169] | 524 | /** The name of this value converted to desired REGFI_ENCODING. |
---|
| 525 | * |
---|
| 526 | * This conversion typically occurs automatically through REGFI_ITERATOR |
---|
| 527 | * settings. String is NUL terminated. |
---|
| 528 | */ |
---|
[206] | 529 | char* name; |
---|
[169] | 530 | |
---|
| 531 | /** The raw value name |
---|
| 532 | * |
---|
| 533 | * Length of the buffer is stored in name_length. |
---|
| 534 | */ |
---|
[206] | 535 | uint8_t* name_raw; |
---|
[169] | 536 | |
---|
[206] | 537 | /** Length of name_raw */ |
---|
[168] | 538 | uint16_t name_length; |
---|
[169] | 539 | |
---|
| 540 | /** Offset from beginning of this hbin block */ |
---|
| 541 | uint32_t hbin_off; |
---|
[53] | 542 | |
---|
[169] | 543 | /** Size of the value's data as reported in the VK record. |
---|
| 544 | * |
---|
| 545 | * May be different than that obtained while parsing the data cell itself. |
---|
| 546 | */ |
---|
| 547 | uint32_t data_size; |
---|
| 548 | |
---|
| 549 | /** Virtual offset of data cell */ |
---|
| 550 | uint32_t data_off; |
---|
| 551 | |
---|
| 552 | /** Value's data type */ |
---|
[193] | 553 | REGFI_DATA_TYPE type; |
---|
[169] | 554 | |
---|
| 555 | /** VK record's magic number (should be "vk") */ |
---|
[168] | 556 | uint8_t magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[169] | 557 | |
---|
| 558 | /** VK record flags */ |
---|
[168] | 559 | uint16_t flags; |
---|
[169] | 560 | |
---|
| 561 | /* XXX: A 2-byte field of unknown purpose stored in the VK record */ |
---|
[168] | 562 | uint16_t unknown1; |
---|
[169] | 563 | |
---|
| 564 | /** Whether or not the data record is stored in the VK record's data_off field. |
---|
| 565 | * |
---|
| 566 | * This information is derived from the high bit of the raw data size field. |
---|
| 567 | */ |
---|
| 568 | bool data_in_offset; |
---|
[206] | 569 | |
---|
| 570 | /* XXX: deprecated */ |
---|
| 571 | REGFI_DATA* data; |
---|
| 572 | |
---|
[203] | 573 | } REGFI_VK; |
---|
[30] | 574 | |
---|
| 575 | |
---|
| 576 | /* Key Security */ |
---|
[206] | 577 | struct _regfi_sk; |
---|
[30] | 578 | |
---|
[169] | 579 | /** Security structure |
---|
| 580 | * @ingroup regfiBase |
---|
| 581 | */ |
---|
[206] | 582 | typedef struct _regfi_sk |
---|
[97] | 583 | { |
---|
[169] | 584 | /** Real file offset of this record */ |
---|
| 585 | uint32_t offset; |
---|
[111] | 586 | |
---|
[169] | 587 | /** ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 588 | uint32_t cell_size; |
---|
| 589 | |
---|
| 590 | /** The stored Windows security descriptor for this SK record */ |
---|
[134] | 591 | WINSEC_DESC* sec_desc; |
---|
[169] | 592 | |
---|
| 593 | /** Offset of this record from beginning of this hbin block */ |
---|
| 594 | uint32_t hbin_off; |
---|
[53] | 595 | |
---|
[169] | 596 | /** Offset of the previous SK record in the linked list of SK records */ |
---|
[168] | 597 | uint32_t prev_sk_off; |
---|
[169] | 598 | |
---|
| 599 | /** Offset of the next SK record in the linked list of SK records */ |
---|
[168] | 600 | uint32_t next_sk_off; |
---|
[169] | 601 | |
---|
| 602 | /** Number of keys referencing this SK record */ |
---|
[168] | 603 | uint32_t ref_count; |
---|
[169] | 604 | |
---|
| 605 | /** Size of security descriptor (sec_desc) */ |
---|
| 606 | uint32_t desc_size; |
---|
| 607 | |
---|
| 608 | /* XXX: A 2-byte field of unknown purpose */ |
---|
[168] | 609 | uint16_t unknown_tag; |
---|
[169] | 610 | |
---|
| 611 | /** The magic number for this record (should be "sk") */ |
---|
[168] | 612 | uint8_t magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[203] | 613 | } REGFI_SK; |
---|
[30] | 614 | |
---|
[81] | 615 | |
---|
[169] | 616 | /** Key structure |
---|
| 617 | * @ingroup regfiBase |
---|
| 618 | */ |
---|
[206] | 619 | typedef struct _regfi_nk |
---|
[97] | 620 | { |
---|
[169] | 621 | /** Real offset of this record's cell in the file */ |
---|
| 622 | uint32_t offset; |
---|
[84] | 623 | |
---|
[169] | 624 | /** Actual or estimated length of the cell. |
---|
| 625 | * Always in multiples of 8. |
---|
| 626 | */ |
---|
| 627 | uint32_t cell_size; |
---|
| 628 | |
---|
| 629 | /** Preloaded value-list for this key. |
---|
| 630 | * This element is loaded automatically when using the iterator interface and |
---|
| 631 | * possibly some lower layer interfaces. |
---|
| 632 | */ |
---|
[145] | 633 | REGFI_VALUE_LIST* values; |
---|
[169] | 634 | |
---|
| 635 | |
---|
| 636 | /** Preloaded subkey-list for this key. |
---|
| 637 | * This element is loaded automatically when using the iterator interface and |
---|
| 638 | * possibly some lower layer interfaces. |
---|
| 639 | */ |
---|
[135] | 640 | REGFI_SUBKEY_LIST* subkeys; |
---|
[53] | 641 | |
---|
[169] | 642 | /** Key flags */ |
---|
[168] | 643 | uint16_t flags; |
---|
[169] | 644 | |
---|
| 645 | /** Magic number of key (should be "nk") */ |
---|
[168] | 646 | uint8_t magic[REGFI_CELL_MAGIC_SIZE]; |
---|
[169] | 647 | |
---|
| 648 | /** Key's last modification time */ |
---|
[168] | 649 | REGFI_NTTIME mtime; |
---|
[169] | 650 | |
---|
[249] | 651 | /** Length of name_raw */ |
---|
[168] | 652 | uint16_t name_length; |
---|
[169] | 653 | |
---|
| 654 | /** Length of referenced classname */ |
---|
[168] | 655 | uint16_t classname_length; |
---|
[169] | 656 | |
---|
| 657 | /** The name of this key converted to desired REGFI_ENCODING. |
---|
| 658 | * |
---|
| 659 | * This conversion typically occurs automatically through REGFI_ITERATOR |
---|
| 660 | * settings. String is NUL terminated. |
---|
| 661 | */ |
---|
[206] | 662 | char* name; |
---|
[169] | 663 | |
---|
| 664 | /** The raw key name |
---|
| 665 | * |
---|
| 666 | * Length of the buffer is stored in name_length. |
---|
| 667 | */ |
---|
[206] | 668 | uint8_t* name_raw; |
---|
[169] | 669 | |
---|
[215] | 670 | /** Virtual offset of parent key */ |
---|
[169] | 671 | uint32_t parent_off; |
---|
| 672 | |
---|
[215] | 673 | /** Virtual offset of classname key */ |
---|
[168] | 674 | uint32_t classname_off; |
---|
[53] | 675 | |
---|
[169] | 676 | /* XXX: max subkey name * 2 */ |
---|
| 677 | uint32_t max_bytes_subkeyname; |
---|
| 678 | |
---|
| 679 | /* XXX: max subkey classname length (as if) */ |
---|
| 680 | uint32_t max_bytes_subkeyclassname; |
---|
| 681 | |
---|
[206] | 682 | /* XXX: max value name * 2 */ |
---|
[169] | 683 | uint32_t max_bytes_valuename; |
---|
| 684 | |
---|
| 685 | /* XXX: max value data size */ |
---|
| 686 | uint32_t max_bytes_value; |
---|
[53] | 687 | |
---|
[169] | 688 | /* XXX: Fields of unknown purpose */ |
---|
[168] | 689 | uint32_t unknown1; |
---|
| 690 | uint32_t unknown2; |
---|
| 691 | uint32_t unknown3; |
---|
| 692 | uint32_t unk_index; /* nigel says run time index ? */ |
---|
[53] | 693 | |
---|
[169] | 694 | /** Number of subkeys */ |
---|
[168] | 695 | uint32_t num_subkeys; |
---|
[169] | 696 | |
---|
| 697 | /** Virtual offset of subkey-list */ |
---|
| 698 | uint32_t subkeys_off; |
---|
| 699 | |
---|
| 700 | /** Number of values for this key */ |
---|
[168] | 701 | uint32_t num_values; |
---|
[169] | 702 | |
---|
| 703 | /** Virtual offset of value-list */ |
---|
| 704 | uint32_t values_off; |
---|
| 705 | |
---|
| 706 | /** Virtual offset of SK record */ |
---|
| 707 | uint32_t sk_off; |
---|
[203] | 708 | } REGFI_NK; |
---|
[30] | 709 | |
---|
[81] | 710 | |
---|
[178] | 711 | typedef struct _regfi_raw_file |
---|
| 712 | { |
---|
[226] | 713 | int64_t (* seek)(); /* (REGFI_RAW_FILE* self, uint64_t offset, int whence) */ |
---|
[178] | 714 | ssize_t (* read)(); /* (REGFI_RAW_FILE* self, void* buf, size_t count) */ |
---|
[97] | 715 | |
---|
[178] | 716 | uint64_t cur_off; |
---|
| 717 | uint64_t size; |
---|
| 718 | void* state; |
---|
| 719 | } REGFI_RAW_FILE; |
---|
| 720 | |
---|
| 721 | |
---|
[169] | 722 | /** Registry hive file data structure |
---|
| 723 | * |
---|
| 724 | * This essential structure stores run-time information about a single open |
---|
| 725 | * registry hive as well as file header (REGF block) data. This structure |
---|
| 726 | * also stores a list of warnings and error messages generated while parsing |
---|
[238] | 727 | * the registry hive. These can be tuned using @ref regfi_log_set_mask. |
---|
[202] | 728 | * Messages may be retrieved using @ref regfi_log_get_str. |
---|
[169] | 729 | * |
---|
| 730 | * @note If the message mask is set to record any messages, dependent code |
---|
[202] | 731 | * must use @ref regfi_log_get_str periodically to clear the message |
---|
[169] | 732 | * queue. Otherwise, this structure will grow in size over time as |
---|
| 733 | * messages queue up. |
---|
| 734 | * |
---|
| 735 | * @ingroup regfiBase |
---|
| 736 | */ |
---|
[178] | 737 | typedef struct _regfi_file |
---|
[97] | 738 | { |
---|
[135] | 739 | /* Data parsed from file header */ |
---|
| 740 | /********************************/ |
---|
[168] | 741 | uint8_t magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */ |
---|
[151] | 742 | |
---|
| 743 | /* These sequence numbers should match if |
---|
| 744 | * the hive was properly synced to disk. |
---|
| 745 | */ |
---|
[168] | 746 | uint32_t sequence1; |
---|
| 747 | uint32_t sequence2; |
---|
[151] | 748 | |
---|
[168] | 749 | REGFI_NTTIME mtime; |
---|
| 750 | uint32_t major_version; /* Set to 1 in all known hives */ |
---|
| 751 | uint32_t minor_version; /* Set to 3 or 5 in all known hives */ |
---|
| 752 | uint32_t type; /* XXX: Unverified. Set to 0 in all known hives */ |
---|
| 753 | uint32_t format; /* XXX: Unverified. Set to 1 in all known hives */ |
---|
[97] | 754 | |
---|
[168] | 755 | uint32_t root_cell; /* Offset to root cell in the first (or any?) hbin block */ |
---|
| 756 | uint32_t last_block; /* Offset to last hbin block in file */ |
---|
[151] | 757 | |
---|
[168] | 758 | uint32_t cluster; /* XXX: Unverified. Set to 1 in all known hives */ |
---|
[151] | 759 | |
---|
| 760 | /* Matches hive's base file name. Stored in UTF-16LE */ |
---|
[168] | 761 | uint8_t file_name[REGFI_REGF_NAME_SIZE]; |
---|
[151] | 762 | |
---|
| 763 | WINSEC_UUID* rm_id; /* XXX: Unverified. */ |
---|
| 764 | WINSEC_UUID* log_id; /* XXX: Unverified. */ |
---|
| 765 | WINSEC_UUID* tm_id; /* XXX: Unverified. */ |
---|
[168] | 766 | uint32_t flags; /* XXX: Unverified. */ |
---|
| 767 | uint32_t guid_signature; /* XXX: Unverified. */ |
---|
[151] | 768 | |
---|
[168] | 769 | uint32_t checksum; /* Stored checksum from file */ |
---|
| 770 | uint32_t computed_checksum; /* Our own calculation of the checksum. |
---|
[151] | 771 | * (XOR of bytes 0x0000 - 0x01FB) */ |
---|
| 772 | |
---|
| 773 | WINSEC_UUID* thaw_tm_id; /* XXX: Unverified. */ |
---|
| 774 | WINSEC_UUID* thaw_rm_id; /* XXX: Unverified. */ |
---|
| 775 | WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */ |
---|
[168] | 776 | uint32_t boot_type; /* XXX: Unverified. */ |
---|
| 777 | uint32_t boot_recover; /* XXX: Unverified. */ |
---|
[151] | 778 | |
---|
| 779 | /* This seems to include random junk. Possibly unsanitized memory left over |
---|
| 780 | * from when header block was written. For instance, chunks of nk records |
---|
| 781 | * can be found, though often it's all 0s. */ |
---|
[168] | 782 | uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE]; |
---|
[151] | 783 | |
---|
| 784 | /* This is likely reserved and unusued currently. (Should be all 0s.) |
---|
| 785 | * Included here for easier access in looking for hidden data |
---|
| 786 | * or doing research. */ |
---|
[168] | 787 | uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE]; |
---|
[151] | 788 | |
---|
[203] | 789 | |
---|
| 790 | /* Run-time information */ |
---|
| 791 | /************************/ |
---|
[206] | 792 | /* For sanity checking (not part of the registry header) */ |
---|
| 793 | uint32_t file_length; |
---|
| 794 | |
---|
| 795 | /** The encoding that all strings are converted to during interpretation. |
---|
| 796 | */ |
---|
| 797 | REGFI_ENCODING string_encoding; |
---|
| 798 | |
---|
[203] | 799 | /* Functions for accessing the file */ |
---|
| 800 | REGFI_RAW_FILE* cb; |
---|
| 801 | |
---|
| 802 | /* Mutex for all cb access. This is done to prevent one thread from moving |
---|
| 803 | * the file offset while another thread is in the middle of a multi-read |
---|
| 804 | * parsing transaction */ |
---|
| 805 | pthread_mutex_t cb_lock; |
---|
| 806 | |
---|
| 807 | /* Metadata about hbins */ |
---|
| 808 | range_list* hbins; |
---|
| 809 | |
---|
| 810 | /* Multiple read access allowed, write access is exclusive */ |
---|
| 811 | pthread_rwlock_t hbins_lock; |
---|
| 812 | |
---|
[250] | 813 | /* Small number of SK records cached */ |
---|
[203] | 814 | lru_cache* sk_cache; |
---|
| 815 | |
---|
| 816 | /* Need exclusive access for LRUs, since lookups make changes */ |
---|
| 817 | pthread_mutex_t sk_lock; |
---|
| 818 | |
---|
[250] | 819 | /* Limited number of keys cached */ |
---|
| 820 | lru_cache* nk_cache; |
---|
| 821 | |
---|
| 822 | /* Need exclusive access for LRUs, since lookups make changes */ |
---|
| 823 | pthread_mutex_t nk_lock; |
---|
| 824 | |
---|
[228] | 825 | /* Needed to protect various talloc calls */ |
---|
| 826 | pthread_mutex_t mem_lock; |
---|
| 827 | |
---|
[135] | 828 | } REGFI_FILE; |
---|
[30] | 829 | |
---|
| 830 | |
---|
[249] | 831 | typedef struct _regfi_iter_position |
---|
| 832 | { |
---|
| 833 | /* key offset */ |
---|
| 834 | uint32_t offset; |
---|
| 835 | |
---|
| 836 | /* Index of the current subkey */ |
---|
| 837 | uint32_t cur_subkey; |
---|
| 838 | |
---|
| 839 | /* Index of the current value */ |
---|
| 840 | uint32_t cur_value; |
---|
| 841 | |
---|
| 842 | /* The number of subkeys of this key */ |
---|
| 843 | uint32_t num_subkeys; |
---|
| 844 | |
---|
| 845 | /* The number of values of this key */ |
---|
| 846 | uint32_t num_values; |
---|
| 847 | |
---|
| 848 | } REGFI_ITER_POSITION; |
---|
| 849 | |
---|
| 850 | |
---|
[169] | 851 | /** Registry hive iterator |
---|
| 852 | * @ingroup regfiIteratorLayer |
---|
| 853 | */ |
---|
[151] | 854 | typedef struct _regfi_iterator |
---|
[97] | 855 | { |
---|
[169] | 856 | /** The registry hive this iterator is associated with */ |
---|
[135] | 857 | REGFI_FILE* f; |
---|
[169] | 858 | |
---|
| 859 | /** All current parent keys and associated iterator positions */ |
---|
[80] | 860 | void_stack* key_positions; |
---|
[169] | 861 | |
---|
[249] | 862 | REGFI_ITER_POSITION* cur; |
---|
[78] | 863 | } REGFI_ITERATOR; |
---|
| 864 | |
---|
[80] | 865 | |
---|
| 866 | |
---|
[169] | 867 | /** General purpose buffer with stored length |
---|
| 868 | * @ingroup regfiBottomLayer |
---|
| 869 | */ |
---|
[151] | 870 | typedef struct _regfi_buffer |
---|
| 871 | { |
---|
[168] | 872 | uint8_t* buf; |
---|
[151] | 873 | uint32_t len; |
---|
| 874 | } REGFI_BUFFER; |
---|
| 875 | |
---|
| 876 | |
---|
[169] | 877 | |
---|
[54] | 878 | /******************************************************************************/ |
---|
[168] | 879 | /** |
---|
[169] | 880 | * @defgroup regfiBase Base Layer: Essential Functions and Data Structures |
---|
[168] | 881 | * |
---|
[169] | 882 | * These functions are either necessary for normal use of the regfi API or just |
---|
| 883 | * don't fit particularly well in any of the other layers. |
---|
[168] | 884 | */ |
---|
[135] | 885 | /******************************************************************************/ |
---|
[166] | 886 | |
---|
[233] | 887 | |
---|
[238] | 888 | |
---|
[233] | 889 | /** Returns the current regfi library version |
---|
| 890 | * |
---|
| 891 | * @return A string indicating the version. |
---|
| 892 | * |
---|
| 893 | * @ingroup regfiBase |
---|
| 894 | */ |
---|
[238] | 895 | _EXPORT() |
---|
[233] | 896 | const char* regfi_version(); |
---|
| 897 | |
---|
| 898 | |
---|
[168] | 899 | /** Parses file headers of an already open registry hive file and |
---|
| 900 | * allocates related structures for further parsing. |
---|
[166] | 901 | * |
---|
[168] | 902 | * @param fd A file descriptor of an already open file. Must be seekable. |
---|
[166] | 903 | * |
---|
[168] | 904 | * @return A reference to a newly allocated REGFI_FILE structure, if successful; |
---|
[184] | 905 | * NULL on error. Use regfi_free to free the returned REGFI_FILE. |
---|
[168] | 906 | * |
---|
| 907 | * @ingroup regfiBase |
---|
[166] | 908 | */ |
---|
[238] | 909 | _EXPORT() |
---|
[206] | 910 | REGFI_FILE* regfi_alloc(int fd, REGFI_ENCODING output_encoding); |
---|
[166] | 911 | |
---|
| 912 | |
---|
[178] | 913 | /** Parses file headers returned by supplied callback functions. |
---|
[166] | 914 | * |
---|
[178] | 915 | * This interface is useful if you have a registry hive in memory |
---|
| 916 | * or have some other reason to emulate a real file. |
---|
[166] | 917 | * |
---|
[178] | 918 | * @param file_cb A structure defining the callback functions needed to access the file. |
---|
[168] | 919 | * |
---|
[178] | 920 | * @return A reference to a newly allocated REGFI_FILE structure, if successful; |
---|
[184] | 921 | * NULL on error. Use regfi_free to free the returned REGFI_FILE. |
---|
[178] | 922 | * |
---|
[168] | 923 | * @ingroup regfiBase |
---|
[166] | 924 | */ |
---|
[238] | 925 | _EXPORT() |
---|
[206] | 926 | REGFI_FILE* regfi_alloc_cb(REGFI_RAW_FILE* file_cb, |
---|
| 927 | REGFI_ENCODING output_encoding); |
---|
[166] | 928 | |
---|
| 929 | |
---|
[168] | 930 | /** Frees a hive's data structures without closing the underlying file. |
---|
[166] | 931 | * |
---|
[168] | 932 | * @param file The registry structure to free. |
---|
| 933 | * |
---|
| 934 | * @ingroup regfiBase |
---|
[166] | 935 | */ |
---|
[238] | 936 | _EXPORT() |
---|
[201] | 937 | void regfi_free(REGFI_FILE* file); |
---|
[166] | 938 | |
---|
| 939 | |
---|
[168] | 940 | /** Get errors, warnings, and/or verbose information relating to processing of |
---|
| 941 | * the given registry file. |
---|
[135] | 942 | * |
---|
[168] | 943 | * @return A newly allocated char* which must be free()d by the caller. |
---|
| 944 | * |
---|
| 945 | * @ingroup regfiBase |
---|
[135] | 946 | */ |
---|
[238] | 947 | _EXPORT() |
---|
[182] | 948 | char* regfi_log_get_str(); |
---|
[159] | 949 | |
---|
[166] | 950 | |
---|
[185] | 951 | /** Set the verbosity level of messages generated by the library for the |
---|
| 952 | * current thread. |
---|
[166] | 953 | * |
---|
[185] | 954 | * @param mask An integer representing the types of messages desired. |
---|
[166] | 955 | * Acceptable values are created through bitwise ORs of |
---|
[185] | 956 | * REGFI_LOG_* values. For instance, if only errors and |
---|
[166] | 957 | * informational messages were desired (but not warnings), |
---|
[185] | 958 | * then one would specify: REGFI_LOG_ERROR|REGFI_LOG_INFO |
---|
| 959 | * By default the message mask is: REGFI_LOG_ERROR|REGFI_LOG_WARN. |
---|
[166] | 960 | * |
---|
[185] | 961 | * @return true on success and false on failure. Failure occurs if |
---|
| 962 | * underlying pthread functions fail. errno is set in this case. |
---|
[182] | 963 | * |
---|
[185] | 964 | * Message masks are set in a thread-specific way. If one were to set a message |
---|
| 965 | * mask in one thread and then spawn a new thread, then the new thread will have |
---|
| 966 | * it's message mask reset to the default. This function may be called at any |
---|
| 967 | * time and will take effect immediately for the current thread. |
---|
[182] | 968 | * |
---|
[185] | 969 | * @note When a non-zero message mask is set, messages will |
---|
| 970 | * accumulate in memory without limit if they are not fetched using |
---|
| 971 | * @ref regfi_get_log_str and subsequently freed by the caller. It is |
---|
| 972 | * recommended that messsages be fetched after each regfi API call in |
---|
| 973 | * order to provide the most context. |
---|
| 974 | * |
---|
[182] | 975 | * @ingroup regfiBase |
---|
| 976 | */ |
---|
[238] | 977 | _EXPORT() |
---|
[185] | 978 | bool regfi_log_set_mask(uint16_t mask); |
---|
[182] | 979 | |
---|
| 980 | |
---|
[215] | 981 | /** Fetches a hive's root key. |
---|
| 982 | * |
---|
| 983 | * @return Returns the root key or NULL on failure. Key must be freed using |
---|
| 984 | * @ref regfi_free_record. |
---|
| 985 | * |
---|
| 986 | * @ingroup regfiBase |
---|
| 987 | */ |
---|
[238] | 988 | _EXPORT() |
---|
[215] | 989 | const REGFI_NK* regfi_get_rootkey(REGFI_FILE* file); |
---|
[168] | 990 | |
---|
[215] | 991 | |
---|
[184] | 992 | /** Frees a record previously returned by one of the API functions. |
---|
[159] | 993 | * |
---|
[228] | 994 | * @param file The file from which the record originated. |
---|
| 995 | * (This is needed for memory management reasons.) |
---|
| 996 | * |
---|
| 997 | * @param record Any of the following record types: REGFI_NK, REGFI_VK, |
---|
| 998 | * REGFI_SK, REGFI_DATA, and REGFI_CLASSNAME records. |
---|
[159] | 999 | * |
---|
[228] | 1000 | * @note The "const" in the record data type is a bit misleading and is there just for |
---|
[184] | 1001 | * convenience. Since records returned previously must not be modified by users |
---|
| 1002 | * of the API due to internal caching, these are returned as const, so this |
---|
[215] | 1003 | * function is const to make passing those records back easy. |
---|
[168] | 1004 | * |
---|
| 1005 | * @ingroup regfiBase |
---|
| 1006 | */ |
---|
[238] | 1007 | _EXPORT() |
---|
[228] | 1008 | void regfi_free_record(REGFI_FILE* file, const void* record); |
---|
[168] | 1009 | |
---|
| 1010 | |
---|
[224] | 1011 | /** Increments reference count on record |
---|
| 1012 | * |
---|
| 1013 | * Adds an extra internal reference to specified record, making it necessary to |
---|
| 1014 | * call regfi_free_record on it an additional time before it is freed. This is |
---|
[252] | 1015 | * useful in cases where multiple threads/structures need access to a shared record, |
---|
[224] | 1016 | * without requiring them to be in sync with when it is freed. |
---|
| 1017 | * |
---|
[228] | 1018 | * @param file The file from which the record originated. |
---|
| 1019 | * (This is needed for memory management reasons.) |
---|
| 1020 | * |
---|
| 1021 | * @param record Any of the following record types: REGFI_NK, REGFI_VK, |
---|
| 1022 | * REGFI_SK, REGFI_DATA, and REGFI_CLASSNAME records. |
---|
[224] | 1023 | * |
---|
[252] | 1024 | * @return Updated record pointer on success, NULL otherwise |
---|
[224] | 1025 | * |
---|
[252] | 1026 | * @note Be sure to use the returned record for further access to the structure |
---|
| 1027 | * instead of the previous version of the pointer. E.g.: |
---|
| 1028 | * @code |
---|
| 1029 | * myKey = (const REGFI_NK*)regfi_reference_record(myFile, myKey); |
---|
| 1030 | * @endcode |
---|
| 1031 | * |
---|
[224] | 1032 | * @ingroup regfiBase |
---|
| 1033 | */ |
---|
[238] | 1034 | _EXPORT() |
---|
[252] | 1035 | const void* regfi_reference_record(REGFI_FILE* file, const void* record); |
---|
[224] | 1036 | |
---|
| 1037 | |
---|
[207] | 1038 | /** Retrieves number of subkeys referenced by this key. |
---|
| 1039 | * |
---|
| 1040 | * Number of subkeyss in key structure and subkey list structure could differ, |
---|
| 1041 | * so this provides a standard/sane way of determining the number. |
---|
| 1042 | * |
---|
| 1043 | * @param key the key whose number of subkeys is desired |
---|
| 1044 | * |
---|
| 1045 | * @return Returns the number of subkeys referenced by this key. |
---|
| 1046 | * |
---|
| 1047 | * @ingroup regfiBase |
---|
| 1048 | */ |
---|
[238] | 1049 | _EXPORT() |
---|
[207] | 1050 | uint32_t regfi_fetch_num_subkeys(const REGFI_NK* key); |
---|
| 1051 | |
---|
| 1052 | |
---|
| 1053 | /** Retrieves number of values referenced by this key. |
---|
| 1054 | * |
---|
| 1055 | * Number of values in key structure and value list structure could differ, |
---|
| 1056 | * so this provides a standard/sane way of determining the number. |
---|
| 1057 | * |
---|
| 1058 | * @param key the key whose number of values is desired |
---|
| 1059 | * |
---|
| 1060 | * @return Returns the number of values referenced by this key. |
---|
| 1061 | * |
---|
| 1062 | * @ingroup regfiBase |
---|
| 1063 | */ |
---|
[238] | 1064 | _EXPORT() |
---|
[207] | 1065 | uint32_t regfi_fetch_num_values(const REGFI_NK* key); |
---|
| 1066 | |
---|
| 1067 | |
---|
[206] | 1068 | /** Retrieves classname for a given key. |
---|
| 1069 | * |
---|
| 1070 | * @param file the file from which key is derived |
---|
| 1071 | * @param key the key whose classname is desired |
---|
| 1072 | * |
---|
| 1073 | * @return Returns a newly allocated classname structure, or NULL on failure. |
---|
| 1074 | * Classname structures must be freed with @ref regfi_free_record. |
---|
| 1075 | * |
---|
| 1076 | * @ingroup regfiBase |
---|
| 1077 | */ |
---|
[238] | 1078 | _EXPORT() |
---|
[206] | 1079 | const REGFI_CLASSNAME* regfi_fetch_classname(REGFI_FILE* file, |
---|
| 1080 | const REGFI_NK* key); |
---|
| 1081 | |
---|
| 1082 | |
---|
| 1083 | /** Returns the SK (security) record referenced by the supplied key. |
---|
| 1084 | * |
---|
| 1085 | * @param file the file from which key is derived |
---|
| 1086 | * @param key the key whose SK record is desired |
---|
| 1087 | * |
---|
| 1088 | * @return A read-only SK structure, or NULL on failure. |
---|
| 1089 | * |
---|
| 1090 | * @ingroup regfiBase |
---|
| 1091 | */ |
---|
[238] | 1092 | _EXPORT() |
---|
[206] | 1093 | const REGFI_SK* regfi_fetch_sk(REGFI_FILE* file, const REGFI_NK* key); |
---|
| 1094 | |
---|
| 1095 | |
---|
| 1096 | /** Retrieves data for a given value. |
---|
| 1097 | * |
---|
| 1098 | * @param file the file from which value is derived |
---|
| 1099 | * @param value the value whose data is desired |
---|
| 1100 | * |
---|
| 1101 | * @return Returns a newly allocated data structure, or NULL on failure. |
---|
| 1102 | * Data structures must be freed with @ref regfi_free_record. |
---|
| 1103 | * |
---|
| 1104 | * @ingroup regfiBase |
---|
| 1105 | */ |
---|
[238] | 1106 | _EXPORT() |
---|
[206] | 1107 | const REGFI_DATA* regfi_fetch_data(REGFI_FILE* file, |
---|
| 1108 | const REGFI_VK* value); |
---|
| 1109 | |
---|
| 1110 | |
---|
[207] | 1111 | /** Locates a specific subkey of a given key. |
---|
| 1112 | * |
---|
| 1113 | * @param file the file from which key is derived |
---|
| 1114 | * @param key the key whose subkey is desired |
---|
| 1115 | * @param name name of the desired subkey |
---|
| 1116 | * @param index a return value: the index of the desired subkey. |
---|
| 1117 | * undefined on error |
---|
| 1118 | * |
---|
| 1119 | * @return true if the subkey is found, false if an error occurred or if the |
---|
| 1120 | * specified name could not be found. If an error occurs, messages |
---|
| 1121 | * will be written explaining the issue. (See regfi_log_get_str.) |
---|
| 1122 | * |
---|
| 1123 | * @ingroup regfiBase |
---|
| 1124 | */ |
---|
[238] | 1125 | _EXPORT() |
---|
[207] | 1126 | bool regfi_find_subkey(REGFI_FILE* file, const REGFI_NK* key, |
---|
| 1127 | const char* name, uint32_t* index); |
---|
| 1128 | |
---|
| 1129 | |
---|
| 1130 | /** Locates a specific value of a given key. |
---|
| 1131 | * |
---|
| 1132 | * @param file the file from which key is derived |
---|
| 1133 | * @param key the key whose value is desired |
---|
| 1134 | * @param name name of the desired value |
---|
| 1135 | * @param index a return value: the index of the desired value. |
---|
| 1136 | * undefined on error |
---|
| 1137 | * |
---|
| 1138 | * @return true if the value is found, false if an error occurred or if the |
---|
| 1139 | * specified name could not be found. If an error occurs, messages |
---|
| 1140 | * will be written explaining the issue. (See regfi_log_get_str.) |
---|
| 1141 | * |
---|
| 1142 | * @ingroup regfiBase |
---|
| 1143 | */ |
---|
[238] | 1144 | _EXPORT() |
---|
[207] | 1145 | bool regfi_find_value(REGFI_FILE* file, const REGFI_NK* key, |
---|
| 1146 | const char* name, uint32_t* index); |
---|
| 1147 | |
---|
| 1148 | |
---|
| 1149 | /** Retrieves a specific subkey of a given key. |
---|
| 1150 | * |
---|
| 1151 | * @param file the file from which key is derived |
---|
| 1152 | * @param key the key whose subkey is desired |
---|
| 1153 | * @param index the index of the desired subkey |
---|
| 1154 | * |
---|
| 1155 | * @return the requested subkey or NULL on error. |
---|
| 1156 | * |
---|
| 1157 | * @ingroup regfiBase |
---|
| 1158 | */ |
---|
[238] | 1159 | _EXPORT() |
---|
[207] | 1160 | const REGFI_NK* regfi_get_subkey(REGFI_FILE* file, const REGFI_NK* key, |
---|
| 1161 | uint32_t index); |
---|
| 1162 | |
---|
| 1163 | |
---|
| 1164 | /** Retrieves a specific value of a given key. |
---|
| 1165 | * |
---|
| 1166 | * @param file the file from which key is derived |
---|
| 1167 | * @param key the key whose value is desired |
---|
| 1168 | * @param index the index of the desired value |
---|
| 1169 | * |
---|
| 1170 | * @return the requested value or NULL on error. |
---|
| 1171 | * |
---|
| 1172 | * @ingroup regfiBase |
---|
| 1173 | */ |
---|
[238] | 1174 | _EXPORT() |
---|
[207] | 1175 | const REGFI_VK* regfi_get_value(REGFI_FILE* file, const REGFI_NK* key, |
---|
| 1176 | uint32_t index); |
---|
| 1177 | |
---|
| 1178 | |
---|
| 1179 | |
---|
[215] | 1180 | /** Uses a key's parent_off reference to retrieve it's parent. |
---|
| 1181 | * |
---|
| 1182 | * @param file the file from which key is derived |
---|
| 1183 | * @param key the key whose parent is desired |
---|
| 1184 | * |
---|
| 1185 | * @return the requested subkey or NULL on error. |
---|
| 1186 | * |
---|
| 1187 | * @ingroup regfiBase |
---|
| 1188 | */ |
---|
[238] | 1189 | _EXPORT() |
---|
[215] | 1190 | const REGFI_NK* regfi_get_parentkey(REGFI_FILE* file, const REGFI_NK* key); |
---|
| 1191 | |
---|
| 1192 | |
---|
[168] | 1193 | /******************************************************************************/ |
---|
| 1194 | /** |
---|
[169] | 1195 | * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface |
---|
[168] | 1196 | * |
---|
| 1197 | * This top layer of API functions provides an iterator interface which makes |
---|
| 1198 | * traversing registry data structures easy in both single-threaded and |
---|
| 1199 | * multi-threaded scenarios. |
---|
| 1200 | */ |
---|
| 1201 | /******************************************************************************/ |
---|
| 1202 | |
---|
| 1203 | /** Creates a new iterator for the provided registry file. |
---|
| 1204 | * |
---|
| 1205 | * @param file The opened registry file the iterator should be created for. |
---|
| 1206 | * |
---|
| 1207 | * @param output_encoding Character encoding that strings should be returned in. |
---|
| 1208 | * Only supply the REGFI_ENCODING_* constants, as others |
---|
| 1209 | * will be rejected. |
---|
| 1210 | * The following values are currently accepted: |
---|
| 1211 | * REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII) |
---|
| 1212 | * REGFI_ENCODING_ASCII |
---|
| 1213 | * REGFI_ENCODING_UTF8 |
---|
| 1214 | * |
---|
| 1215 | * @return A newly allocated REGFI_ITERATOR. |
---|
| 1216 | * Must be free()d with regfi_iterator_free. |
---|
| 1217 | * |
---|
[169] | 1218 | * @ingroup regfiIteratorLayer |
---|
[168] | 1219 | */ |
---|
[238] | 1220 | _EXPORT() |
---|
[206] | 1221 | REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* file); |
---|
[166] | 1222 | |
---|
| 1223 | |
---|
[168] | 1224 | /** Frees a registry file iterator previously created by regfi_iterator_new. |
---|
[166] | 1225 | * |
---|
| 1226 | * This does not affect the underlying registry file's allocation status. |
---|
| 1227 | * |
---|
[168] | 1228 | * @param i the iterator to be freed |
---|
| 1229 | * |
---|
[169] | 1230 | * @ingroup regfiIteratorLayer |
---|
[166] | 1231 | */ |
---|
[238] | 1232 | _EXPORT() |
---|
[201] | 1233 | void regfi_iterator_free(REGFI_ITERATOR* i); |
---|
[166] | 1234 | |
---|
| 1235 | |
---|
[168] | 1236 | /** Traverse deeper into the registry tree at the current subkey. |
---|
[166] | 1237 | * |
---|
[168] | 1238 | * @param i the iterator |
---|
[166] | 1239 | * |
---|
[168] | 1240 | * @return true on success, false on failure. |
---|
| 1241 | * Note that subkey and value indexes are preserved. That is, if a |
---|
| 1242 | * regfi_iterator_up call occurs later (reversing the effect of this |
---|
| 1243 | * call) then the subkey and value referenced prior to the |
---|
| 1244 | * regfi_iterator_down call will still be referenced. This makes |
---|
| 1245 | * depth-first iteration particularly easy. |
---|
| 1246 | * |
---|
[169] | 1247 | * @ingroup regfiIteratorLayer |
---|
[166] | 1248 | */ |
---|
[238] | 1249 | _EXPORT() |
---|
[201] | 1250 | bool regfi_iterator_down(REGFI_ITERATOR* i); |
---|
[166] | 1251 | |
---|
| 1252 | |
---|
[168] | 1253 | /** Traverse up to the current key's parent key. |
---|
[166] | 1254 | * |
---|
[168] | 1255 | * @param i the iterator |
---|
[166] | 1256 | * |
---|
[168] | 1257 | * @return true on success, false on failure. Any subkey or value state |
---|
| 1258 | * associated with the current key is lost. |
---|
| 1259 | * |
---|
[169] | 1260 | * @ingroup regfiIteratorLayer |
---|
[166] | 1261 | */ |
---|
[238] | 1262 | _EXPORT() |
---|
[201] | 1263 | bool regfi_iterator_up(REGFI_ITERATOR* i); |
---|
[166] | 1264 | |
---|
| 1265 | |
---|
[168] | 1266 | /** Traverse up to the root key of the hive. |
---|
[166] | 1267 | * |
---|
[168] | 1268 | * @param i the iterator |
---|
[166] | 1269 | * |
---|
[168] | 1270 | * @return true on success, false on failure. |
---|
| 1271 | * |
---|
[169] | 1272 | * @ingroup regfiIteratorLayer |
---|
[166] | 1273 | */ |
---|
[238] | 1274 | _EXPORT() |
---|
[201] | 1275 | bool regfi_iterator_to_root(REGFI_ITERATOR* i); |
---|
[30] | 1276 | |
---|
[166] | 1277 | |
---|
[168] | 1278 | /** Traverse down multiple levels in the registry hive. |
---|
[166] | 1279 | * |
---|
| 1280 | * XXX: This currently only accepts ASCII key names. Need to look into |
---|
| 1281 | * accepting other encodings. |
---|
| 1282 | * |
---|
[168] | 1283 | * @param i the iterator |
---|
| 1284 | * @param path a list of key names representing the path. This list must |
---|
| 1285 | * contain NUL terminated strings. The list itself is |
---|
| 1286 | * terminated with a NULL pointer. All path elements must be |
---|
| 1287 | * keys; value names are not accepted (even as the last |
---|
| 1288 | * element). |
---|
| 1289 | * |
---|
| 1290 | * @return true on success, false on failure. If any element of path is not |
---|
| 1291 | * found, false will be returned and the iterator will remain |
---|
| 1292 | * in its original position. |
---|
| 1293 | * |
---|
[169] | 1294 | * @ingroup regfiIteratorLayer |
---|
[166] | 1295 | */ |
---|
[238] | 1296 | _EXPORT() |
---|
[252] | 1297 | bool regfi_iterator_descend(REGFI_ITERATOR* i, const char** path); |
---|
[166] | 1298 | |
---|
| 1299 | |
---|
[168] | 1300 | /** Returns the currently referenced key. |
---|
[166] | 1301 | * |
---|
[168] | 1302 | * @param i the iterator |
---|
[166] | 1303 | * |
---|
[168] | 1304 | * @return A read-only key structure for the current key, or NULL on failure. |
---|
[221] | 1305 | * Data structures must be freed with @ref regfi_free_record. |
---|
[168] | 1306 | * |
---|
[169] | 1307 | * @ingroup regfiIteratorLayer |
---|
[166] | 1308 | */ |
---|
[238] | 1309 | _EXPORT() |
---|
[203] | 1310 | const REGFI_NK* regfi_iterator_cur_key(REGFI_ITERATOR* i); |
---|
[166] | 1311 | |
---|
| 1312 | |
---|
[168] | 1313 | /** Sets the internal subkey index to the first subkey referenced by the current |
---|
[200] | 1314 | * key. |
---|
[166] | 1315 | * |
---|
[168] | 1316 | * @param i the iterator |
---|
[166] | 1317 | * |
---|
[200] | 1318 | * @return True if the current key has any subkeys, false otherwise. |
---|
[168] | 1319 | * |
---|
[169] | 1320 | * @ingroup regfiIteratorLayer |
---|
[166] | 1321 | */ |
---|
[238] | 1322 | _EXPORT() |
---|
[199] | 1323 | bool regfi_iterator_first_subkey(REGFI_ITERATOR* i); |
---|
[166] | 1324 | |
---|
| 1325 | |
---|
[168] | 1326 | /** Returns the currently indexed subkey. |
---|
[166] | 1327 | * |
---|
[168] | 1328 | * @param i the iterator |
---|
[166] | 1329 | * |
---|
[168] | 1330 | * @return A newly allocated key structure for the currently referenced subkey, |
---|
| 1331 | * or NULL on failure. Newly allocated keys must be freed with |
---|
[185] | 1332 | * @ref regfi_free_record. |
---|
[168] | 1333 | * |
---|
[169] | 1334 | * @ingroup regfiIteratorLayer |
---|
[166] | 1335 | */ |
---|
[238] | 1336 | _EXPORT() |
---|
[203] | 1337 | const REGFI_NK* regfi_iterator_cur_subkey(REGFI_ITERATOR* i); |
---|
[167] | 1338 | |
---|
| 1339 | |
---|
[200] | 1340 | /** Increments the internal subkey index to the next key in the subkey-list. |
---|
[167] | 1341 | * |
---|
[168] | 1342 | * @param i the iterator |
---|
[167] | 1343 | * |
---|
[200] | 1344 | * @return True if another subkey should exist, false otherwise. |
---|
[168] | 1345 | * |
---|
[169] | 1346 | * @ingroup regfiIteratorLayer |
---|
[167] | 1347 | */ |
---|
[238] | 1348 | _EXPORT() |
---|
[199] | 1349 | bool regfi_iterator_next_subkey(REGFI_ITERATOR* i); |
---|
[167] | 1350 | |
---|
| 1351 | |
---|
[168] | 1352 | /** Searches for a subkey with a given name under the current key. |
---|
[167] | 1353 | * |
---|
[207] | 1354 | * @param i the iterator |
---|
| 1355 | * @param name subkey name to search for |
---|
[167] | 1356 | * |
---|
[168] | 1357 | * @return True if such a subkey was found, false otherwise. If a subkey is |
---|
| 1358 | * found, the current subkey index is set to that subkey. Otherwise, |
---|
| 1359 | * the subkey index remains at the same location as before the call. |
---|
| 1360 | * |
---|
[169] | 1361 | * @ingroup regfiIteratorLayer |
---|
[167] | 1362 | */ |
---|
[238] | 1363 | _EXPORT() |
---|
[207] | 1364 | bool regfi_iterator_find_subkey(REGFI_ITERATOR* i, const char* name); |
---|
[150] | 1365 | |
---|
[184] | 1366 | |
---|
[168] | 1367 | /** Sets the internal value index to the first value referenced by the current |
---|
[200] | 1368 | * key. |
---|
[167] | 1369 | * |
---|
[168] | 1370 | * @param i the iterator |
---|
[167] | 1371 | * |
---|
[200] | 1372 | * @return True if the current key has any values, false otherwise. |
---|
[168] | 1373 | * |
---|
[169] | 1374 | * @ingroup regfiIteratorLayer |
---|
[167] | 1375 | */ |
---|
[238] | 1376 | _EXPORT() |
---|
[199] | 1377 | bool regfi_iterator_first_value(REGFI_ITERATOR* i); |
---|
[167] | 1378 | |
---|
| 1379 | |
---|
[168] | 1380 | /** Returns the currently indexed value. |
---|
[167] | 1381 | * |
---|
[168] | 1382 | * @param i the iterator |
---|
[167] | 1383 | * |
---|
[168] | 1384 | * @return A newly allocated value structure for the currently referenced value, |
---|
| 1385 | * or NULL on failure. Newly allocated values must be freed with |
---|
[185] | 1386 | * @ref regfi_free_record. |
---|
[168] | 1387 | * |
---|
[169] | 1388 | * @ingroup regfiIteratorLayer |
---|
[167] | 1389 | */ |
---|
[238] | 1390 | _EXPORT() |
---|
[203] | 1391 | const REGFI_VK* regfi_iterator_cur_value(REGFI_ITERATOR* i); |
---|
[167] | 1392 | |
---|
| 1393 | |
---|
[200] | 1394 | /** Increments the internal value index to the next value in the value-list. |
---|
[167] | 1395 | * |
---|
[168] | 1396 | * @param i the iterator |
---|
[167] | 1397 | * |
---|
[200] | 1398 | * @return True if another value should exist, false otherwise. |
---|
[168] | 1399 | * |
---|
[169] | 1400 | * @ingroup regfiIteratorLayer |
---|
[167] | 1401 | */ |
---|
[238] | 1402 | _EXPORT() |
---|
[199] | 1403 | bool regfi_iterator_next_value(REGFI_ITERATOR* i); |
---|
[167] | 1404 | |
---|
| 1405 | |
---|
[168] | 1406 | /** Searches for a value with a given name under the current key. |
---|
[167] | 1407 | * |
---|
[207] | 1408 | * @param i the iterator |
---|
| 1409 | * @param name value name to search for |
---|
[167] | 1410 | * |
---|
[168] | 1411 | * @return True if such a value was found, false otherwise. If a value is |
---|
| 1412 | * found, the current value index is set to that value. Otherwise, |
---|
| 1413 | * the value index remains at the same location as before the call. |
---|
| 1414 | * |
---|
[169] | 1415 | * @ingroup regfiIteratorLayer |
---|
[167] | 1416 | */ |
---|
[238] | 1417 | _EXPORT() |
---|
[207] | 1418 | bool regfi_iterator_find_value(REGFI_ITERATOR* i, const char* name); |
---|
[80] | 1419 | |
---|
[167] | 1420 | |
---|
[252] | 1421 | /** Returns the current key and all parent keys as a list of NK records |
---|
[249] | 1422 | * |
---|
| 1423 | * @param i the iterator |
---|
| 1424 | * |
---|
| 1425 | * @return An array of NK record pointers terminated by a NULL pointer. |
---|
| 1426 | * This array may be passed directly to regfi_free_record to free |
---|
[252] | 1427 | * the entire array. |
---|
[249] | 1428 | * |
---|
| 1429 | * @note In order to use an element of the array independently from the |
---|
| 1430 | * array (that is, to hold a pointer to an individual NK record while |
---|
| 1431 | * freeing the remaining array), callers must first use |
---|
| 1432 | * regfi_reference_record on the elements to be kept. |
---|
| 1433 | * |
---|
| 1434 | * @ingroup regfiIteratorLayer |
---|
| 1435 | */ |
---|
| 1436 | _EXPORT() |
---|
[252] | 1437 | const REGFI_NK** regfi_iterator_ancestry(REGFI_ITERATOR* i); |
---|
[249] | 1438 | |
---|
| 1439 | |
---|
[168] | 1440 | /******************************************************************************/ |
---|
| 1441 | /** |
---|
[169] | 1442 | * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading |
---|
[168] | 1443 | */ |
---|
| 1444 | /******************************************************************************/ |
---|
| 1445 | |
---|
[215] | 1446 | /** Loads a key and associated data structures given a file offset. |
---|
[168] | 1447 | * |
---|
| 1448 | * XXX: finish documenting |
---|
| 1449 | * |
---|
[169] | 1450 | * @ingroup regfiGlueLayer |
---|
[168] | 1451 | */ |
---|
[238] | 1452 | _EXPORT() |
---|
[203] | 1453 | REGFI_NK* regfi_load_key(REGFI_FILE* file, uint32_t offset, |
---|
[215] | 1454 | REGFI_ENCODING output_encoding, |
---|
| 1455 | bool strict); |
---|
[168] | 1456 | |
---|
| 1457 | |
---|
| 1458 | /** Loads a value at a given file offset alng with associated data structures. |
---|
| 1459 | * |
---|
| 1460 | * XXX: finish documenting |
---|
| 1461 | * |
---|
[169] | 1462 | * @ingroup regfiGlueLayer |
---|
[168] | 1463 | */ |
---|
[238] | 1464 | _EXPORT() |
---|
[203] | 1465 | REGFI_VK* regfi_load_value(REGFI_FILE* file, uint32_t offset, |
---|
[201] | 1466 | REGFI_ENCODING output_encoding, |
---|
| 1467 | bool strict); |
---|
[168] | 1468 | |
---|
| 1469 | |
---|
| 1470 | /** Loads a logical subkey list in its entirety which may span multiple records. |
---|
| 1471 | * |
---|
| 1472 | * XXX: finish documenting |
---|
| 1473 | * |
---|
[169] | 1474 | * @ingroup regfiGlueLayer |
---|
[168] | 1475 | */ |
---|
[238] | 1476 | _EXPORT() |
---|
[201] | 1477 | REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset, |
---|
| 1478 | uint32_t num_keys, uint32_t max_size, |
---|
| 1479 | bool strict); |
---|
[168] | 1480 | |
---|
| 1481 | |
---|
| 1482 | /** Loads a valuelist. |
---|
| 1483 | * |
---|
| 1484 | * XXX: finish documenting |
---|
| 1485 | * |
---|
[169] | 1486 | * @ingroup regfiGlueLayer |
---|
[168] | 1487 | */ |
---|
[238] | 1488 | _EXPORT() |
---|
[201] | 1489 | REGFI_VALUE_LIST* regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, |
---|
| 1490 | uint32_t num_values, uint32_t max_size, |
---|
| 1491 | bool strict); |
---|
[127] | 1492 | |
---|
[168] | 1493 | |
---|
| 1494 | /** Loads a data record which may be contained in the virtual offset, in a |
---|
| 1495 | * single cell, or in multiple cells through big data records. |
---|
| 1496 | * |
---|
| 1497 | * XXX: finish documenting |
---|
| 1498 | * |
---|
[169] | 1499 | * @ingroup regfiGlueLayer |
---|
[168] | 1500 | */ |
---|
[238] | 1501 | _EXPORT() |
---|
[201] | 1502 | REGFI_BUFFER regfi_load_data(REGFI_FILE* file, uint32_t voffset, |
---|
| 1503 | uint32_t length, bool data_in_offset, |
---|
| 1504 | bool strict); |
---|
[157] | 1505 | |
---|
[168] | 1506 | |
---|
| 1507 | /** Loads the data associated with a big data record at the specified offset. |
---|
| 1508 | * |
---|
| 1509 | * XXX: finish documenting |
---|
| 1510 | * |
---|
[169] | 1511 | * @ingroup regfiGlueLayer |
---|
[168] | 1512 | */ |
---|
[238] | 1513 | _EXPORT() |
---|
[201] | 1514 | REGFI_BUFFER regfi_load_big_data(REGFI_FILE* file, uint32_t offset, |
---|
| 1515 | uint32_t data_length,uint32_t cell_length, |
---|
| 1516 | range_list* used_ranges, |
---|
| 1517 | bool strict); |
---|
[168] | 1518 | |
---|
| 1519 | |
---|
| 1520 | /** Given raw data, attempts to interpret the data based on a specified registry |
---|
| 1521 | * data type. |
---|
| 1522 | * |
---|
| 1523 | * XXX: finish documenting |
---|
| 1524 | * |
---|
[169] | 1525 | * @ingroup regfiGlueLayer |
---|
[168] | 1526 | */ |
---|
[238] | 1527 | _EXPORT() |
---|
[201] | 1528 | bool regfi_interpret_data(REGFI_FILE* file, |
---|
| 1529 | REGFI_ENCODING string_encoding, |
---|
| 1530 | uint32_t type, REGFI_DATA* data); |
---|
[168] | 1531 | |
---|
| 1532 | |
---|
| 1533 | |
---|
[146] | 1534 | /* These are cached so return values don't need to be freed. */ |
---|
[168] | 1535 | |
---|
| 1536 | /** Loads an "sk" security record at the specified offset. |
---|
| 1537 | * |
---|
| 1538 | * XXX: finish documenting |
---|
| 1539 | * |
---|
[169] | 1540 | * @ingroup regfiGlueLayer |
---|
[168] | 1541 | */ |
---|
[238] | 1542 | _EXPORT() |
---|
[203] | 1543 | const REGFI_SK* regfi_load_sk(REGFI_FILE* file, uint32_t offset, |
---|
[201] | 1544 | bool strict); |
---|
[146] | 1545 | |
---|
| 1546 | |
---|
[206] | 1547 | |
---|
| 1548 | |
---|
[168] | 1549 | /** Retrieves the HBIN data structure stored at the specified offset. |
---|
| 1550 | * |
---|
| 1551 | * XXX: finish documenting |
---|
| 1552 | * |
---|
[169] | 1553 | * @ingroup regfiGlueLayer |
---|
[168] | 1554 | */ |
---|
[238] | 1555 | _EXPORT() |
---|
[201] | 1556 | const REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset); |
---|
[168] | 1557 | |
---|
| 1558 | |
---|
| 1559 | |
---|
| 1560 | /******************************************************************************/ |
---|
| 1561 | /** |
---|
[169] | 1562 | * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access |
---|
[168] | 1563 | */ |
---|
| 1564 | /******************************************************************************/ |
---|
| 1565 | |
---|
[238] | 1566 | _EXPORT() |
---|
[201] | 1567 | REGFI_FILE* regfi_parse_regf(REGFI_RAW_FILE* file_cb, bool strict); |
---|
[80] | 1568 | |
---|
[238] | 1569 | _EXPORT() |
---|
[201] | 1570 | REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, |
---|
| 1571 | bool strict); |
---|
[99] | 1572 | |
---|
[201] | 1573 | |
---|
[168] | 1574 | /** Parses an NK record at the specified offset |
---|
[99] | 1575 | * |
---|
[168] | 1576 | * @param file the registry file structure |
---|
| 1577 | * @param offset the offset of the cell (not the record) to be parsed. |
---|
| 1578 | * @param max_size the maximum size the NK cell could be. (for validation) |
---|
| 1579 | * @param strict if true, rejects any malformed records. Otherwise, |
---|
| 1580 | * tries to minimally validate integrity. |
---|
| 1581 | * |
---|
| 1582 | * @return A newly allocated NK record structure, or NULL on failure. |
---|
| 1583 | * |
---|
[169] | 1584 | * @ingroup regfiParseLayer |
---|
[99] | 1585 | */ |
---|
[238] | 1586 | _EXPORT() |
---|
[203] | 1587 | REGFI_NK* regfi_parse_nk(REGFI_FILE* file, uint32_t offset, |
---|
[201] | 1588 | uint32_t max_size, bool strict); |
---|
[99] | 1589 | |
---|
[139] | 1590 | |
---|
[168] | 1591 | /** Parses a single cell containing a subkey-list record. |
---|
| 1592 | * |
---|
| 1593 | * XXX: finish documenting |
---|
| 1594 | * |
---|
[169] | 1595 | * @ingroup regfiParseLayer |
---|
[168] | 1596 | */ |
---|
[238] | 1597 | _EXPORT() |
---|
[201] | 1598 | REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset, |
---|
| 1599 | uint32_t max_size, bool strict); |
---|
[103] | 1600 | |
---|
[111] | 1601 | |
---|
[168] | 1602 | /** Parses a VK (value) record at the specified offset |
---|
| 1603 | * |
---|
| 1604 | * XXX: finish documenting |
---|
| 1605 | * |
---|
[169] | 1606 | * @ingroup regfiParseLayer |
---|
[168] | 1607 | */ |
---|
[238] | 1608 | _EXPORT() |
---|
[203] | 1609 | REGFI_VK* regfi_parse_vk(REGFI_FILE* file, uint32_t offset, |
---|
[201] | 1610 | uint32_t max_size, bool strict); |
---|
[168] | 1611 | |
---|
| 1612 | |
---|
| 1613 | /** Parses an SK (security) record at the specified offset |
---|
| 1614 | * |
---|
| 1615 | * XXX: finish documenting |
---|
| 1616 | * |
---|
[169] | 1617 | * @ingroup regfiParseLayer |
---|
[168] | 1618 | */ |
---|
[238] | 1619 | _EXPORT() |
---|
[203] | 1620 | REGFI_SK* regfi_parse_sk(REGFI_FILE* file, uint32_t offset, |
---|
[201] | 1621 | uint32_t max_size, bool strict); |
---|
[168] | 1622 | |
---|
| 1623 | |
---|
| 1624 | /** Retrieves information on all cells in the registry hive which are |
---|
| 1625 | * currently in the unallocated status. |
---|
| 1626 | * |
---|
| 1627 | * The unallocated status is determined based soley on the cell length sign. |
---|
| 1628 | * |
---|
| 1629 | * XXX: finish documenting |
---|
| 1630 | * |
---|
[169] | 1631 | * @ingroup regfiParseLayer |
---|
[168] | 1632 | */ |
---|
[238] | 1633 | _EXPORT() |
---|
[201] | 1634 | range_list* regfi_parse_unalloc_cells(REGFI_FILE* file); |
---|
[101] | 1635 | |
---|
[111] | 1636 | |
---|
[168] | 1637 | /** Helper function to parse a cell |
---|
| 1638 | * |
---|
| 1639 | * XXX: finish documenting |
---|
| 1640 | * |
---|
[169] | 1641 | * @ingroup regfiParseLayer |
---|
[168] | 1642 | */ |
---|
[238] | 1643 | _EXPORT() |
---|
[201] | 1644 | bool regfi_parse_cell(REGFI_RAW_FILE* file_cb, uint32_t offset, |
---|
| 1645 | uint8_t* hdr, uint32_t hdr_len, |
---|
| 1646 | uint32_t* cell_length, bool* unalloc); |
---|
[126] | 1647 | |
---|
[157] | 1648 | |
---|
[168] | 1649 | /** Parses a classname cell |
---|
| 1650 | * |
---|
| 1651 | * XXX: finish documenting |
---|
| 1652 | * |
---|
[169] | 1653 | * @ingroup regfiParseLayer |
---|
[168] | 1654 | */ |
---|
[238] | 1655 | _EXPORT() |
---|
[201] | 1656 | uint8_t* regfi_parse_classname(REGFI_FILE* file, uint32_t offset, |
---|
| 1657 | uint16_t* name_length, |
---|
| 1658 | uint32_t max_size, bool strict); |
---|
[157] | 1659 | |
---|
| 1660 | |
---|
[168] | 1661 | /** Parses a single-cell data record |
---|
| 1662 | * |
---|
| 1663 | * XXX: finish documenting |
---|
| 1664 | * |
---|
[169] | 1665 | * @ingroup regfiParseLayer |
---|
[168] | 1666 | */ |
---|
[238] | 1667 | _EXPORT() |
---|
[201] | 1668 | REGFI_BUFFER regfi_parse_data(REGFI_FILE* file, uint32_t offset, |
---|
| 1669 | uint32_t length, bool strict); |
---|
[127] | 1670 | |
---|
[150] | 1671 | |
---|
[168] | 1672 | /** Parses a "little data" record which is stored entirely within the |
---|
| 1673 | * provided virtual offset. |
---|
| 1674 | * |
---|
| 1675 | * XXX: finish documenting |
---|
| 1676 | * |
---|
[169] | 1677 | * @ingroup regfiParseLayer |
---|
[168] | 1678 | */ |
---|
[238] | 1679 | _EXPORT() |
---|
[201] | 1680 | REGFI_BUFFER regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, |
---|
| 1681 | uint32_t length, bool strict); |
---|
[150] | 1682 | |
---|
[168] | 1683 | |
---|
| 1684 | /******************************************************************************/ |
---|
[215] | 1685 | /* Private (and undocumented) Functions */ |
---|
[168] | 1686 | /******************************************************************************/ |
---|
[226] | 1687 | int64_t regfi_raw_seek(REGFI_RAW_FILE* self, |
---|
| 1688 | uint64_t offset, int whence); |
---|
[178] | 1689 | ssize_t regfi_raw_read(REGFI_RAW_FILE* self, |
---|
| 1690 | void* buf, size_t count); |
---|
[238] | 1691 | _EXPORT() |
---|
[226] | 1692 | uint64_t regfi_seek(REGFI_RAW_FILE* file_cb, |
---|
| 1693 | uint64_t offset, int whence); |
---|
[238] | 1694 | _EXPORT() |
---|
[178] | 1695 | uint32_t regfi_read(REGFI_RAW_FILE* file_cb, |
---|
| 1696 | uint8_t* buf, uint32_t* length); |
---|
| 1697 | |
---|
[238] | 1698 | _EXPORT() |
---|
[135] | 1699 | const char* regfi_type_val2str(unsigned int val); |
---|
[238] | 1700 | _EXPORT() |
---|
[135] | 1701 | int regfi_type_str2val(const char* str); |
---|
[127] | 1702 | |
---|
[238] | 1703 | _EXPORT() |
---|
[135] | 1704 | char* regfi_get_sacl(WINSEC_DESC* sec_desc); |
---|
[238] | 1705 | _EXPORT() |
---|
[135] | 1706 | char* regfi_get_dacl(WINSEC_DESC* sec_desc); |
---|
[238] | 1707 | _EXPORT() |
---|
[135] | 1708 | char* regfi_get_owner(WINSEC_DESC* sec_desc); |
---|
[238] | 1709 | _EXPORT() |
---|
[135] | 1710 | char* regfi_get_group(WINSEC_DESC* sec_desc); |
---|
| 1711 | |
---|
[168] | 1712 | REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16_t num_lists, |
---|
[135] | 1713 | REGFI_SUBKEY_LIST** lists, |
---|
| 1714 | bool strict); |
---|
[168] | 1715 | REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset, |
---|
| 1716 | uint32_t max_size, bool strict, |
---|
| 1717 | uint8_t depth_left); |
---|
| 1718 | void regfi_add_message(REGFI_FILE* file, uint16_t msg_type, |
---|
[138] | 1719 | const char* fmt, ...); |
---|
[206] | 1720 | REGFI_NK* regfi_copy_nk(const REGFI_NK* nk); |
---|
| 1721 | REGFI_VK* regfi_copy_vk(const REGFI_VK* vk); |
---|
[238] | 1722 | _EXPORT() |
---|
[168] | 1723 | int32_t regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset); |
---|
| 1724 | int32_t regfi_conv_charset(const char* input_charset, |
---|
[161] | 1725 | const char* output_charset, |
---|
[168] | 1726 | uint8_t* input, char* output, |
---|
| 1727 | uint32_t input_len, uint32_t output_max); |
---|
[238] | 1728 | _EXPORT() |
---|
[159] | 1729 | REGFI_DATA* regfi_buffer_to_data(REGFI_BUFFER raw_data); |
---|
[146] | 1730 | |
---|
[168] | 1731 | /* XXX: move to base API and document */ |
---|
[238] | 1732 | _EXPORT() |
---|
[251] | 1733 | REGFI_NTTIME regfi_unix2nt_time(time_t t); |
---|
[238] | 1734 | _EXPORT() |
---|
[251] | 1735 | double regfi_nt2unix_time(REGFI_NTTIME nt); |
---|
[168] | 1736 | |
---|
| 1737 | |
---|
[238] | 1738 | _EXPORT() |
---|
[203] | 1739 | void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK* nk, |
---|
[172] | 1740 | REGFI_ENCODING output_encoding, bool strict); |
---|
[238] | 1741 | _EXPORT() |
---|
[203] | 1742 | void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK* vk, |
---|
[172] | 1743 | REGFI_ENCODING output_encoding, bool strict); |
---|
| 1744 | |
---|
[238] | 1745 | _EXPORT() |
---|
[202] | 1746 | void regfi_init(); |
---|
[172] | 1747 | |
---|
[202] | 1748 | |
---|
[78] | 1749 | #endif /* _REGFI_H */ |
---|