source: trunk/include/regfi.h @ 141

Last change on this file since 141 was 140, checked in by tim, 16 years ago

Misc error message changes.

Added and removed some comments.

Updated TODO list.
  • Property svn:keywords set to Id
File size: 16.3 KB
Line 
1/*
2 * Branched from Samba project Subversion repository, version #6903:
3 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Windows NT (and later) registry parsing library
6 *
7 * Copyright (C) 2005-2009 Timothy D. Morgan
8 * Copyright (C) 2005 Gerald (Jerry) Carter
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; version 3 of the License.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 *
23 * $Id: regfi.h 140 2009-02-09 19:53:39Z tim $
24 */
25
26/************************************************************
27 * Most of this information was obtained from
28 * http://www.wednesday.demon.co.uk/dosreg.html
29 * Thanks Nigel!
30 ***********************************************************/
31
32#ifndef _REGFI_H
33#define _REGFI_H
34
35#include <stdlib.h>
36#include <stdio.h>
37#include <stdbool.h>
38#include <stdarg.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "winsec.h"
50#include "void_stack.h"
51#include "range_list.h"
52#include "lru_cache.h"
53
54/******************************************************************************/
55
56/* regfi library error message types */
57#define REGFI_MSG_INFO  0x0001
58#define REGFI_MSG_WARN  0x0004
59#define REGFI_MSG_ERROR 0x0010
60
61/* Registry data types */
62#define REG_NONE                       0
63#define REG_SZ                         1
64#define REG_EXPAND_SZ                  2
65#define REG_BINARY                     3
66#define REG_DWORD                      4
67#define REG_DWORD_LE                   4  /* DWORD, little endian */
68#define REG_DWORD_BE                   5  /* DWORD, big endian */
69#define REG_LINK                       6
70#define REG_MULTI_SZ                   7
71#define REG_RESOURCE_LIST              8
72#define REG_FULL_RESOURCE_DESCRIPTOR   9
73#define REG_RESOURCE_REQUIREMENTS_LIST 10
74#define REG_QWORD                      11 /* 64-bit little endian */
75/* XXX: Has MS defined a REG_QWORD_BE? */
76/* Not a real type in the registry */
77#define REG_KEY                    0x7FFFFFFF
78
79#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
80#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
81#define REGFI_MAX_DEPTH            512
82#define REGFI_OFFSET_NONE          0xffffffff
83
84/* XXX: This is totally arbitrary right now. */
85#define REGFI_MAX_SUBKEY_DEPTH     255   
86
87/* Header sizes and magic number lengths for various records */
88#define REGFI_REGF_MAGIC_SIZE      4
89#define REGFI_HBIN_MAGIC_SIZE      4
90#define REGFI_CELL_MAGIC_SIZE      2
91#define REGFI_HBIN_HEADER_SIZE     0x20
92#define REGFI_NK_MIN_LENGTH        0x4C
93#define REGFI_VK_MIN_LENGTH        0x14
94#define REGFI_SK_MIN_LENGTH        0x14
95#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
96
97
98/* Constants used for validation */
99/* XXX: Can we add clock resolution validation as well as range?  It has
100 *      been reported that Windows timestamps are never more than a
101 *      certain granularity (250ms?), which could be used to help
102 *      eliminate false positives.  Would need to validate this and
103 *      perhaps conservatively implement a check.
104 */
105 /* Minimum time is Jan 1, 1990 00:00:00 */
106#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
107#define REGFI_MTIME_MIN_LOW        0x26F98000
108 /* Maximum time is Jan 1, 2290 00:00:00
109  * (We hope no one is using Windows by then...)
110  */
111#define REGFI_MTIME_MAX_HIGH       0x03047543
112#define REGFI_MTIME_MAX_LOW        0xC80A4000
113
114
115/* Flags for the vk records */
116#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
117#define REGFI_VK_DATA_IN_OFFSET    0x80000000
118#define REGFI_VK_MAX_DATA_LENGTH   1024*1024
119
120
121/* NK record types */
122/* XXX: This is starting to look like this is a flags field. 
123 *      Need to decipher the meaning of each flag.
124 */
125#define REGFI_NK_TYPE_LINKKEY      0x0010
126#define REGFI_NK_TYPE_NORMALKEY    0x0020
127 /* XXX: Unknown key type that shows up in Vista registries */
128#define REGFI_NK_TYPE_UNKNOWN1     0x1020
129 /* XXX: Unknown key types that shows up in W2K3 registries */
130#define REGFI_NK_TYPE_UNKNOWN2     0x4020
131#define REGFI_NK_TYPE_UNKNOWN3     0x0000  /* XXX: This type seems to have UTF-16 names!!! */
132#define REGFI_NK_TYPE_ROOTKEY1     0x002c
133 /* XXX: Unknown root key type that shows up in Vista registries */
134#define REGFI_NK_TYPE_ROOTKEY2     0x00ac
135
136#if 0
137/* Initial hypothesis of NK flags: */
138/***********************************/
139#define REGFI_NK_FLAG_LINK         0x0010
140/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
141#define REGFI_NK_FLAG_ASCIINAME    0x0020
142/* These next two combine to form the "c" on both known root key types */
143#define REGFI_NK_FLAG_ROOT1        0x0008
144#define REGFI_NK_FLAG_ROOT2        0x0004
145/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
146#define REGFI_NK_FLAG_UNKNOWN1     0x4000
147#define REGFI_NK_FLAG_UNKNOWN2     0x1000
148/* This next one shows up on root keys in some Vista "software" registries */
149#define REGFI_NK_FLAG_UNKNOWN3     0x0080
150#endif
151
152
153
154/* HBIN block */
155typedef struct _regfi_hbin
156{
157  uint32 file_off;       /* my offset in the registry file */
158  uint32 ref_count;      /* how many active records are pointing to this
159                          * block (not used currently)
160                          */
161 
162  uint32 first_hbin_off; /* offset from first hbin block */
163  uint32 block_size;     /* block size of this block
164                          * Should be a multiple of 4096 (0x1000)
165                          */
166  uint32 next_block;     /* relative offset to next block. 
167                          * NOTE: This value may be unreliable!
168                          */
169
170  uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
171} REGFI_HBIN;
172
173
174/* Subkey List -- list of key offsets and hashed names for consistency */
175typedef struct 
176{
177  /* Virtual offset of NK record or additional subkey list,
178   * depending on this list's type.
179   */
180  uint32 offset;
181
182  uint32 hash;
183} REGFI_SUBKEY_LIST_ELEM;
184
185
186typedef struct 
187{
188  /* Real offset of this record's cell in the file */
189  uint32 offset;
190
191  uint32 cell_size;
192 
193  /* Number of immediate children */
194  uint32 num_children; 
195
196  /* Total number of keys referenced by this list and it's children */
197  uint32 num_keys;     
198
199  REGFI_SUBKEY_LIST_ELEM* elements;
200  uint8 magic[REGFI_CELL_MAGIC_SIZE];
201
202  /* Set if the magic indicates this subkey list points to child subkey lists */
203  bool recursive_type; 
204} REGFI_SUBKEY_LIST;
205
206
207/* Key Value */
208typedef struct 
209{
210  uint32 offset;        /* Real offset of this record's cell in the file */
211  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
212
213  REGFI_HBIN* hbin;     /* pointer to HBIN record (in memory) containing
214                         * this nk record
215                         */
216  uint8* data;
217  uint16 name_length;
218  char*  valuename;
219  uint32 hbin_off;      /* offset from beginning of this hbin block */
220 
221  uint32 data_size;
222  uint32 data_off;      /* offset of data cell (virtual) */
223  uint32 type;
224  uint8  magic[REGFI_CELL_MAGIC_SIZE];
225  uint16 flag;
226  uint16 unknown1;
227  bool data_in_offset;
228} REGFI_VK_REC;
229
230
231/* Key Security */
232struct _regfi_sk_rec;
233
234typedef struct _regfi_sk_rec
235{
236  uint32 offset;        /* Real file offset of this record */
237  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
238
239  WINSEC_DESC* sec_desc;
240  uint32 hbin_off;      /* offset from beginning of this hbin block */
241 
242  uint32 sk_off;        /* offset parsed from NK record used as a key
243                         * to lookup reference to this SK record
244                         */
245 
246  uint32 prev_sk_off;
247  uint32 next_sk_off;
248  uint32 ref_count;
249  uint32 desc_size;     /* size of security descriptor */
250  uint16 unknown_tag;
251  uint8  magic[REGFI_CELL_MAGIC_SIZE];
252} REGFI_SK_REC;
253
254
255/* Key Name */
256typedef struct
257{
258  uint32 offset;        /* Real offset of this record's cell in the file */
259  uint32 cell_size;     /* Actual or estimated length of the cell. 
260                         * Always in multiples of 8.
261                         */
262
263  /* link in the other records here */
264  REGFI_VK_REC** values;
265  REGFI_SUBKEY_LIST* subkeys;
266 
267  /* header information */
268  uint16 key_type;
269  uint8  magic[REGFI_CELL_MAGIC_SIZE];
270  NTTIME mtime;
271  uint16 name_length;
272  uint16 classname_length;
273  char* classname;
274  char* keyname;
275  uint32 parent_off;                /* pointer to parent key */
276  uint32 classname_off;
277 
278  /* max lengths */
279  uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
280  uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
281  uint32 max_bytes_valuename;       /* max valuename * 2 */
282  uint32 max_bytes_value;           /* max value data size */
283 
284  /* unknowns */
285  uint32 unknown1;
286  uint32 unknown2;
287  uint32 unknown3;
288  uint32 unk_index;                 /* nigel says run time index ? */
289 
290  /* children */
291  uint32 num_subkeys;
292  uint32 subkeys_off;   /* offset of subkey list that points to NK records */
293  uint32 num_values;
294  uint32 values_off;    /* value lists which point to VK records */
295  uint32 sk_off;        /* offset to SK record */
296} REGFI_NK_REC;
297
298
299
300/* REGF block */
301typedef struct 
302{
303  /* Run-time information */
304  /************************/
305  /* file descriptor */
306  int fd;
307
308  /* For sanity checking (not part of the registry header) */
309  uint32 file_length;
310
311  /* Metadata about hbins */
312  range_list* hbins;
313
314  /* Error/warning/info messages returned by lower layer functions */
315  char* last_message;
316
317  /* Mask for error message types that will be stored. */
318  uint16 msg_mask;
319
320
321  /* Data parsed from file header */
322  /********************************/
323  uint8  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
324  NTTIME mtime;
325  uint32 data_offset;           /* offset to record in the first (or any?)
326                                 * hbin block
327                                 */
328  uint32 last_block;            /* offset to last hbin block in file */
329
330  uint32 checksum;              /* Stored checksum. */
331  uint32 computed_checksum;     /* Our own calculation of the checksum.
332                                 * (XOR of bytes 0x0000 - 0x01FB)
333                                 */
334 
335  /* XXX: Some of these we have some clues about (major/minor version, etc).
336   *      Should verify and update names accordingly.
337   */
338  /* unknown data structure values */
339  uint32 unknown1;
340  uint32 unknown2;
341  uint32 unknown3;
342  uint32 unknown4;
343  uint32 unknown5;
344  uint32 unknown6;
345  uint32 unknown7;
346} REGFI_FILE;
347
348
349/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
350 *      structure, probably REGFI_FILE.  Once key caching is in place,
351 *      convert key_positions stack to store just key offsets rather than
352 *      whole keys.
353 */
354typedef struct 
355{
356  REGFI_FILE* f;
357  void_stack* key_positions;
358  lru_cache* sk_recs;
359  REGFI_NK_REC* cur_key;
360  uint32 cur_subkey;
361  uint32 cur_value;
362} REGFI_ITERATOR;
363
364
365typedef struct 
366{
367  /* XXX: Should probably eliminate the storage of keys here
368   *      once key caching is implemented.
369   */
370  REGFI_NK_REC* nk;
371  uint32 cur_subkey;
372  /* We could store a cur_value here as well, but didn't see
373   * the use in it right now.
374   */
375} REGFI_ITER_POSITION;
376
377
378/******************************************************************************/
379/*                         Main iterator API                                  */
380/******************************************************************************/
381REGFI_FILE*           regfi_open(const char* filename);
382int                   regfi_close(REGFI_FILE* r);
383
384/* regfi_get_messages: Get errors, warnings, and/or verbose information
385 *                     relating to processing of the given registry file.
386 *
387 * Arguments:
388 *   file     -- the structure for the registry file
389 *
390 * Returns:
391 *   A newly allocated char* which must be free()d by the caller.
392 */
393char*                 regfi_get_messages(REGFI_FILE* file);
394void                  regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
395
396REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* fh);
397void                  regfi_iterator_free(REGFI_ITERATOR* i);
398bool                  regfi_iterator_down(REGFI_ITERATOR* i);
399bool                  regfi_iterator_up(REGFI_ITERATOR* i);
400bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
401
402bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
403                                                 const char* subkey_name);
404bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i, 
405                                               const char** path);
406const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
407const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
408const REGFI_NK_REC*   regfi_iterator_first_subkey(REGFI_ITERATOR* i);
409const REGFI_NK_REC*   regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
410const REGFI_NK_REC*   regfi_iterator_next_subkey(REGFI_ITERATOR* i);
411
412bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
413                                                const char* value_name);
414const REGFI_VK_REC*   regfi_iterator_first_value(REGFI_ITERATOR* i);
415const REGFI_VK_REC*   regfi_iterator_cur_value(REGFI_ITERATOR* i);
416const REGFI_VK_REC*   regfi_iterator_next_value(REGFI_ITERATOR* i);
417
418
419/********************************************************/
420/* Middle-layer structure caching, loading, and linking */
421/********************************************************/
422REGFI_HBIN*           regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
423REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32 offset, 
424                                     bool strict);
425REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32 offset, 
426                                            uint32 num_keys, uint32 max_size, 
427                                            bool strict);
428REGFI_VK_REC**        regfi_load_valuelist(REGFI_FILE* file, uint32 offset, 
429                                           uint32 num_values, uint32 max_size, 
430                                           bool strict);
431
432/************************************/
433/*  Low-layer data structure access */
434/************************************/
435REGFI_FILE*           regfi_parse_regf(int fd, bool strict);
436REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32 offset, 
437                                       bool strict);
438
439
440/* regfi_parse_nk: Parses an NK record.
441 *
442 * Arguments:
443 *   f        -- the registry file structure
444 *   offset   -- the offset of the cell (not the record) to be parsed.
445 *   max_size -- the maximum size the NK cell could be. (for validation)
446 *   strict   -- if true, rejects any malformed records.  Otherwise,
447 *               tries to minimally validate integrity.
448 * Returns:
449 *   A newly allocated NK record structure, or NULL on failure.
450 */
451REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32 offset, 
452                                     uint32 max_size, bool strict);
453
454REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
455                                             uint32 max_size, bool strict);
456
457REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32 offset, 
458                                     uint32 max_size, bool strict);
459
460uint8*                regfi_parse_data(REGFI_FILE* file, uint32 offset, 
461                                       uint32 length, uint32 max_size, 
462                                       bool strict);
463
464REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32 offset, 
465                                     uint32 max_size, bool strict);
466
467range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
468
469bool                  regfi_parse_cell(int fd, uint32 offset, 
470                                       uint8* hdr, uint32 hdr_len,
471                                       uint32* cell_length, bool* unalloc);
472
473char*                 regfi_parse_classname(REGFI_FILE* file, uint32 offset,
474                                            uint16* name_length, 
475                                            uint32 max_size, bool strict);
476
477
478/************************************/
479/*    Private Functions             */
480/************************************/
481REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file);
482void                  regfi_key_free(REGFI_NK_REC* nk);
483void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
484uint32                regfi_read(int fd, uint8* buf, uint32* length);
485
486const char*           regfi_type_val2str(unsigned int val);
487int                   regfi_type_str2val(const char* str);
488
489char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
490char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
491char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
492char*                 regfi_get_group(WINSEC_DESC* sec_desc);
493
494REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16 num_lists, 
495                                              REGFI_SUBKEY_LIST** lists,
496                                              bool strict);
497REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
498                                                uint32 max_size, bool strict,
499                                                uint8 depth_left);
500void                  regfi_add_message(REGFI_FILE* file, uint16 msg_type, 
501                                        const char* fmt, ...);
502#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.