source: trunk/include/regfi.h @ 173

Last change on this file since 173 was 172, checked in by tim, 15 years ago

reorganized name interpretation code to correct issues in reglookup-recover

  • Property svn:keywords set to Id
File size: 41.5 KB
Line 
1/*
2 * Copyright (C) 2005-2010 Timothy D. Morgan
3 * Copyright (C) 2005 Gerald (Jerry) Carter
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; version 3 of the License.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17 *
18 * $Id: regfi.h 172 2010-03-08 03:04:34Z tim $
19 */
20
21/**
22 * @file
23 * Windows NT (and later) read-only registry library
24 *
25 * This library is intended for use in digital forensics investigations, but
26 * is likely useful in other applications.
27 *
28 * Branched from Samba project Subversion repository, version #6903:
29 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
30 *
31 * Since then, it has been heavily rewritten, simplified, and improved.
32 */
33
34/**
35 * @mainpage Home
36 *
37 * The regfi library is a read-only NT registry library which serves as the main
38 * engine behind the reglookup tool.  It is designed with digital forensic
39 * analysis in mind, but it should also be useful in other tools which need to
40 * efficiently traverse and query registry data structures.
41 *
42 * The library is broken down into four main parts, the
43 * @ref regfiBase "Base Layer", which any code dependent on the library will
44 * likely need to rely on, as well as three main functional layers:
45 * @li @ref regfiIteratorLayer
46 * @li @ref regfiGlueLayer
47 * @li @ref regfiParseLayer
48 *
49 * Most users will find that a combination of the Base Layer and the Iterator Layer
50 * will be sufficient for accessing registry hive files.  Those who are wiling
51 * to dive deep into registry data structures, for instance to recover deleted
52 * data structures or to research Windows registry behavior in detail, will
53 * find the Parse Layer to be quite useful.
54 */
55
56
57#ifndef _REGFI_H
58#define _REGFI_H
59
60#include <stdlib.h>
61#include <stdio.h>
62#include <stdbool.h>
63#include <string.h>
64#include <errno.h>
65#include <time.h>
66#include <fcntl.h>
67#include <sys/stat.h>
68#include <sys/types.h>
69#include <unistd.h>
70#include <iconv.h>
71
72#include "byteorder.h"
73#include "talloc.h"
74#include "winsec.h"
75#include "void_stack.h"
76#include "range_list.h"
77#include "lru_cache.h"
78
79/******************************************************************************/
80
81/* regfi library error message types */
82#define REGFI_MSG_INFO  0x0001
83#define REGFI_MSG_WARN  0x0004
84#define REGFI_MSG_ERROR 0x0010
85
86typedef uint8_t REGFI_ENCODING;
87/* regfi library supported character encodings */
88#define REGFI_ENCODING_ASCII   0
89#define REGFI_ENCODING_UTF8    1
90#define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII
91/* UTF16LE is not supported for output */
92#define REGFI_ENCODING_UTF16LE 2
93
94#define REGFI_NUM_ENCODINGS    3
95
96/* Windows is lame */
97#ifdef O_BINARY
98#define REGFI_OPEN_FLAGS O_RDONLY|O_BINARY
99#else
100#define REGFI_OPEN_FLAGS O_RDONLY
101#endif
102
103/* Registry data types */
104#define REG_NONE                       0
105#define REG_SZ                         1
106#define REG_EXPAND_SZ                  2
107#define REG_BINARY                     3
108#define REG_DWORD                      4
109#define REG_DWORD_LE                   4  /* DWORD, little endian */
110#define REG_DWORD_BE                   5  /* DWORD, big endian */
111#define REG_LINK                       6
112#define REG_MULTI_SZ                   7
113#define REG_RESOURCE_LIST              8
114#define REG_FULL_RESOURCE_DESCRIPTOR   9
115#define REG_RESOURCE_REQUIREMENTS_LIST 10
116#define REG_QWORD                      11 /* 64-bit little endian */
117/* XXX: Has MS defined a REG_QWORD_BE? */
118/* Not a real type in the registry */
119#define REG_KEY                    0x7FFFFFFF
120
121#define REGFI_OFFSET_NONE          0xffffffff
122
123
124/* This maximum depth is described here:
125 * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
126 */
127#define REGFI_MAX_DEPTH            512
128
129/* This limit defines the maximum number of levels deep that ri subkey list
130 * trees can go.
131 */
132/* XXX: This is totally arbitrary right now.
133 *      The actual limit may need to be discovered by experimentation.
134 */
135#define REGFI_MAX_SUBKEY_DEPTH     255
136
137
138/* Header sizes and magic number lengths for various records */
139#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
140#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
141#define REGFI_REGF_MAGIC_SIZE      4
142#define REGFI_REGF_NAME_SIZE       64
143#define REGFI_REGF_RESERVED1_SIZE  340
144#define REGFI_REGF_RESERVED2_SIZE  3528
145#define REGFI_HBIN_MAGIC_SIZE      4
146#define REGFI_CELL_MAGIC_SIZE      2
147#define REGFI_HBIN_HEADER_SIZE     0x20
148#define REGFI_NK_MIN_LENGTH        0x4C
149#define REGFI_VK_MIN_LENGTH        0x14
150#define REGFI_SK_MIN_LENGTH        0x14
151#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
152#define REGFI_BIG_DATA_MIN_LENGTH  0xC
153
154
155/* Constants used for validation */
156/* XXX: Can we add clock resolution validation as well as range?  It has
157 *      been reported that Windows timestamps are never more than a
158 *      certain granularity (250ms?), which could be used to help
159 *      eliminate false positives.  Would need to verify this and
160 *      perhaps conservatively implement a check.
161 */
162 /* Minimum time is Jan 1, 1990 00:00:00 */
163#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
164#define REGFI_MTIME_MIN_LOW        0x26F98000
165 /* Maximum time is Jan 1, 2290 00:00:00
166  * (We hope no one is using Windows by then...)
167  */
168#define REGFI_MTIME_MAX_HIGH       0x03047543
169#define REGFI_MTIME_MAX_LOW        0xC80A4000
170
171
172/* Flags for the vk records */
173#define REGFI_VK_FLAG_ASCIINAME    0x0001
174#define REGFI_VK_DATA_IN_OFFSET    0x80000000
175#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
176
177
178/* Known key flags */
179/*******************/
180/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
181#define REGFI_NK_FLAG_UNKNOWN1     0x4000
182#define REGFI_NK_FLAG_UNKNOWN2     0x1000
183
184/* This next one shows up in some Vista "software" registries */
185/* XXX: This shows up in the following two SOFTWARE keys in Vista:
186 *   /Wow6432Node/Microsoft
187 *   /Wow6432Node/Microsoft/Cryptography
188 * 
189 * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0
190 */
191#define REGFI_NK_FLAG_UNKNOWN3     0x0080
192
193/* Predefined handle.  Rumor has it that the valuelist count for this key is
194 * where the handle is stored.
195 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
196 */
197#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
198
199/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
200#define REGFI_NK_FLAG_ASCIINAME    0x0020
201
202/* Symlink key. 
203 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
204 */
205#define REGFI_NK_FLAG_LINK         0x0010
206
207/* This key cannot be deleted */
208#define REGFI_NK_FLAG_NO_RM        0x0008
209
210/* Root of a hive */
211#define REGFI_NK_FLAG_ROOT         0x0004
212
213/* Mount point of another hive.  NULL/(default) value indicates which hive
214 * and where in the hive it points to.
215 */
216#define REGFI_NK_FLAG_HIVE_LINK    0x0002
217
218/* These keys shouldn't be stored on disk, according to:
219 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
220 */
221#define REGFI_NK_FLAG_VOLATILE     0x0001
222
223/* Useful for identifying unknown flag types */
224#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
225                                    | REGFI_NK_FLAG_ASCIINAME\
226                                    | REGFI_NK_FLAG_LINK\
227                                    | REGFI_NK_FLAG_NO_RM\
228                                    | REGFI_NK_FLAG_ROOT\
229                                    | REGFI_NK_FLAG_HIVE_LINK\
230                                    | REGFI_NK_FLAG_VOLATILE\
231                                    | REGFI_NK_FLAG_UNKNOWN1\
232                                    | REGFI_NK_FLAG_UNKNOWN2\
233                                    | REGFI_NK_FLAG_UNKNOWN3)
234
235
236#define CHAR_BIT 8
237#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
238                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
239#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
240#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
241
242typedef struct _regfi_nttime
243{
244  uint32_t low;
245  uint32_t high;
246} REGFI_NTTIME;
247
248
249/** HBIN block information
250 * @ingroup regfiMiddleLayer
251 */
252typedef struct _regfi_hbin
253{
254  /** Offset of this HBIN in the registry file */
255  uint32_t file_off;
256
257  /** Number of active records pointing to this block (not used currently) */
258  uint32_t ref_count;
259
260  /** Offset from first hbin block */
261  uint32_t first_hbin_off;
262
263  /** Block size of this block Should be a multiple of 4096 (0x1000) */
264  uint32_t block_size;
265
266  /** Relative offset to next block. 
267   *
268   * @note This value may be unreliable!
269   */
270  uint32_t next_block;
271
272  /** Magic number for the HBIN (should be "hbin"). */
273  uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
274} REGFI_HBIN;
275
276
277/* Subkey List -- list of key offsets and hashed names for consistency */
278typedef struct 
279{
280  /* Virtual offset of NK record or additional subkey list,
281   * depending on this list's type.
282   */
283  uint32_t offset;
284
285  uint32_t hash;
286} REGFI_SUBKEY_LIST_ELEM;
287
288
289/** Subkey-list structure
290 * @ingroup regfiMiddleLayer
291 */
292typedef struct _regfi_subkey_list
293{
294  /* Real offset of this record's cell in the file */
295  uint32_t offset;
296
297  uint32_t cell_size;
298 
299  /* Number of immediate children */
300  uint32_t num_children; 
301
302  /* Total number of keys referenced by this list and it's children */
303  uint32_t num_keys;     
304
305  REGFI_SUBKEY_LIST_ELEM* elements;
306  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
307
308  /* Set if the magic indicates this subkey list points to child subkey lists */
309  bool recursive_type; 
310} REGFI_SUBKEY_LIST;
311
312
313typedef uint32_t REGFI_VALUE_LIST_ELEM;
314/** Value-list structure
315 * @ingroup regfiMiddleLayer
316 */
317typedef struct _regfi_value_list
318{
319  /* Actual number of values referenced by this list. 
320   * May differ from parent key's num_values if there were parsing errors.
321   */
322  uint32_t num_values;
323
324  REGFI_VALUE_LIST_ELEM* elements;
325} REGFI_VALUE_LIST;
326
327
328/** Class name structure (used in storing SysKeys)
329 * @ingroup regfiBase
330 */
331typedef struct _regfi_classname
332{
333  /** As converted to requested REGFI_ENCODING */
334  char* interpreted;
335
336  /** Represents raw buffer read from classname cell.
337   *
338   * Length of this item is specified in the size field.
339   */
340  uint8_t* raw;
341
342  /** Length of the raw data.
343   *
344   * May be shorter than that indicated by parent key.
345   */
346  uint16_t size;
347} REGFI_CLASSNAME;
348
349
350/** Data record structure
351 * @ingroup regfiBase
352 */
353typedef struct _regfi_data
354{
355  /** Data type of this data, as indicated by the referencing VK record. */
356  uint32_t type;
357
358  /** Length of the raw data. */
359  uint32_t size;
360
361  /** This is always present, representing the raw data cell contents. */
362  uint8_t* raw;
363
364  /** Represents the length of the interpreted value. Meaning is type-specific. */
365  uint32_t interpreted_size;
366
367  /** These items represent interpreted versions of the REGFI_DATA::raw field.
368   *
369   * Only use the appropriate member according to the REGFI_DATA::type field.
370   * In the event of an unknown type, use only the REGFI_DATA::raw field.
371   */
372  union _regfi_data_interpreted
373  {
374    /** REG_NONE
375     *
376     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
377     * length.
378     */
379    uint8_t* none; 
380
381    /** REG_SZ
382     *
383     * Stored as a NUL terminated string.  Converted to the specified
384     * REGFI_ENCODING.
385     */
386    uint8_t* string;
387
388    /** REG_EXPAND_SZ
389     *
390     * Stored as a NUL terminated string.  Converted to the specified
391     * REGFI_ENCODING.
392     */
393    uint8_t* expand_string;
394
395    /** REG_BINARY
396     *
397     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
398     * length.
399     */
400    uint8_t* binary;
401
402    /** REG_DWORD */
403    uint32_t dword;
404
405    /** REG_DWORD_BE */
406    uint32_t dword_be;
407
408    /** REG_LINK
409     *
410     * Stored as a NUL terminated string.  Converted to the specified
411     * REGFI_ENCODING.
412     */
413    uint8_t* link;
414
415    /** REG_MULTI_SZ
416     *
417     * Stored as a list of uint8_t* pointers, terminated with a NULL pointer.
418     * Each string element in the list is NUL terminated, and the character set
419     * is determined by the specified REGFI_ENCODING.
420     */
421    uint8_t** multiple_string;
422
423    /** REG_QWORD */
424    uint64_t qword;
425
426    /* The following are treated as binary currently, but this may change in
427     * the future as the formats become better understood.
428     */
429
430    /** REG_RESOURCE_LIST
431     *
432     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
433     * length.
434     */
435    uint8_t* resource_list;
436
437    /** REG_FULL_RESOURCE_DESCRIPTOR
438     *
439     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
440     * length.
441     */
442    uint8_t* full_resource_descriptor;
443
444    /** REG_RESOURCE_REQUIREMENTS_LIST
445     *
446     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
447     * length.
448     */
449    uint8_t* resource_requirements_list;
450  } interpreted;
451} REGFI_DATA;
452
453
454/** Value structure
455 * @ingroup regfiBase
456 */
457typedef struct
458{
459  /** Real offset of this record's cell in the file */
460  uint32_t offset;     
461
462  /** ((start_offset - end_offset) & 0xfffffff8) */
463  uint32_t cell_size;
464
465  /* XXX: deprecated */
466  REGFI_DATA* data;
467
468  /** The name of this value converted to desired REGFI_ENCODING. 
469   *
470   * This conversion typically occurs automatically through REGFI_ITERATOR
471   * settings.  String is NUL terminated.
472   */
473  char*    valuename;
474
475  /** The raw value name
476   *
477   * Length of the buffer is stored in name_length.
478   */
479  uint8_t* valuename_raw;
480
481  /** Length of valuename_raw */
482  uint16_t name_length;
483
484  /** Offset from beginning of this hbin block */
485  uint32_t hbin_off;
486 
487  /** Size of the value's data as reported in the VK record.
488   *
489   * May be different than that obtained while parsing the data cell itself.
490   */
491  uint32_t data_size;
492
493  /** Virtual offset of data cell */
494  uint32_t data_off;
495
496  /** Value's data type */
497  uint32_t type;
498
499  /** VK record's magic number (should be "vk") */
500  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
501
502  /** VK record flags */
503  uint16_t flags;
504
505  /* XXX: A 2-byte field of unknown purpose stored in the VK record */
506  uint16_t unknown1;
507
508  /** Whether or not the data record is stored in the VK record's data_off field.
509   *
510   * This information is derived from the high bit of the raw data size field.
511   */
512  bool     data_in_offset;
513} REGFI_VK_REC;
514
515
516/* Key Security */
517struct _regfi_sk_rec;
518
519/** Security structure
520 * @ingroup regfiBase
521 */
522typedef struct _regfi_sk_rec
523{
524  /** Real file offset of this record */
525  uint32_t offset;
526
527  /** ((start_offset - end_offset) & 0xfffffff8) */
528  uint32_t cell_size;
529
530  /** The stored Windows security descriptor for this SK record */
531  WINSEC_DESC* sec_desc;
532
533  /** Offset of this record from beginning of this hbin block */
534  uint32_t hbin_off;
535 
536  /** Offset of the previous SK record in the linked list of SK records */
537  uint32_t prev_sk_off;
538
539  /** Offset of the next SK record in the linked list of SK records */
540  uint32_t next_sk_off;
541
542  /** Number of keys referencing this SK record */
543  uint32_t ref_count;
544
545  /** Size of security descriptor (sec_desc) */
546  uint32_t desc_size;
547
548  /* XXX: A 2-byte field of unknown purpose */
549  uint16_t unknown_tag;
550
551  /** The magic number for this record (should be "sk") */
552  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
553} REGFI_SK_REC;
554
555
556/** Key structure
557 * @ingroup regfiBase
558 */
559typedef struct
560{
561  /** Real offset of this record's cell in the file */
562  uint32_t offset;
563
564  /** Actual or estimated length of the cell. 
565   * Always in multiples of 8.
566   */
567  uint32_t cell_size;
568
569  /** Preloaded value-list for this key.
570   * This element is loaded automatically when using the iterator interface and
571   * possibly some lower layer interfaces.
572   */
573  REGFI_VALUE_LIST* values;
574
575
576  /** Preloaded subkey-list for this key.
577   * This element is loaded automatically when using the iterator interface and
578   * possibly some lower layer interfaces.
579   */
580  REGFI_SUBKEY_LIST* subkeys;
581 
582  /** Key flags */
583  uint16_t flags;
584
585  /** Magic number of key (should be "nk") */
586  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
587
588  /** Key's last modification time */
589  REGFI_NTTIME mtime;
590
591  /** Length of keyname_raw */
592  uint16_t name_length;
593
594  /** Length of referenced classname */
595  uint16_t classname_length;
596
597  /** The name of this key converted to desired REGFI_ENCODING. 
598   *
599   * This conversion typically occurs automatically through REGFI_ITERATOR
600   * settings.  String is NUL terminated.
601   */
602  char* keyname;
603
604  /** The raw key name
605   *
606   * Length of the buffer is stored in name_length.
607   */
608  uint8_t* keyname_raw;
609
610  /** Virutal offset of parent key */
611  uint32_t parent_off;
612
613  /** Virutal offset of classname key */
614  uint32_t classname_off;
615 
616  /* XXX: max subkey name * 2 */
617  uint32_t max_bytes_subkeyname;
618
619  /* XXX: max subkey classname length (as if) */
620  uint32_t max_bytes_subkeyclassname;
621
622  /* XXX: max valuename * 2 */
623  uint32_t max_bytes_valuename;
624
625  /* XXX: max value data size */
626  uint32_t max_bytes_value;
627 
628  /* XXX: Fields of unknown purpose */
629  uint32_t unknown1;
630  uint32_t unknown2;
631  uint32_t unknown3;
632  uint32_t unk_index;               /* nigel says run time index ? */
633 
634  /** Number of subkeys */
635  uint32_t num_subkeys;
636
637  /** Virtual offset of subkey-list */
638  uint32_t subkeys_off;
639
640  /** Number of values for this key */
641  uint32_t num_values;
642
643  /** Virtual offset of value-list */
644  uint32_t values_off;
645
646  /** Virtual offset of SK record */
647  uint32_t sk_off;
648} REGFI_NK_REC;
649
650
651
652/** Registry hive file data structure
653 *
654 * This essential structure stores run-time information about a single open
655 * registry hive as well as file header (REGF block) data.  This structure
656 * also stores a list of warnings and error messages generated while parsing
657 * the registry hive.  These can be tuned using @ref regfi_set_message_mask. 
658 * Messages may be retrieved using @ref regfi_get_messages.
659 *
660 * @note If the message mask is set to record any messages, dependent code
661 *       must use @ref regfi_get_messages periodically to clear the message
662 *       queue. Otherwise, this structure will grow in size over time as
663 *       messages queue up.
664 *
665 * @ingroup regfiBase
666 */ 
667typedef struct 
668{
669  /* Run-time information */
670  /************************/
671  /* file descriptor */
672  int fd;
673
674  /* For sanity checking (not part of the registry header) */
675  uint32_t file_length;
676
677  /* Metadata about hbins */
678  range_list* hbins;
679
680  /* SK record cached since they're repeatedly reused */
681  lru_cache* sk_cache;
682
683  /* Error/warning/info messages returned by lower layer functions */
684  char* last_message;
685
686  /* Mask for error message types that will be stored. */
687  uint16_t msg_mask;
688
689
690  /* Data parsed from file header */
691  /********************************/
692  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
693
694 /* These sequence numbers should match if
695  * the hive was properly synced to disk.
696  */
697  uint32_t sequence1;           
698  uint32_t sequence2;
699
700  REGFI_NTTIME mtime;
701  uint32_t major_version;  /* Set to 1 in all known hives */
702  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
703  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
704  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
705
706  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
707  uint32_t last_block; /* Offset to last hbin block in file */
708
709  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
710
711  /* Matches hive's base file name. Stored in UTF-16LE */
712  uint8_t file_name[REGFI_REGF_NAME_SIZE];
713
714  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
715  WINSEC_UUID* log_id;      /* XXX: Unverified. */
716  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
717  uint32_t flags;             /* XXX: Unverified. */
718  uint32_t guid_signature;    /* XXX: Unverified. */
719
720  uint32_t checksum;          /* Stored checksum from file */
721  uint32_t computed_checksum; /* Our own calculation of the checksum.
722                             * (XOR of bytes 0x0000 - 0x01FB) */
723
724  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
725  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
726  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
727  uint32_t boot_type;         /* XXX: Unverified. */
728  uint32_t boot_recover;      /* XXX: Unverified. */
729
730  /* This seems to include random junk.  Possibly unsanitized memory left over
731   * from when header block was written.  For instance, chunks of nk records
732   * can be found, though often it's all 0s. */
733  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
734
735  /* This is likely reserved and unusued currently.  (Should be all 0s.)
736   * Included here for easier access in looking for hidden data
737   * or doing research. */
738  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
739
740} REGFI_FILE;
741
742
743/** Registry hive iterator
744 * @ingroup regfiIteratorLayer
745 */
746typedef struct _regfi_iterator
747{
748  /** The registry hive this iterator is associated with */
749  REGFI_FILE* f;
750
751  /** All current parent keys and associated iterator positions */
752  void_stack* key_positions;
753
754  /** The current key */
755  REGFI_NK_REC* cur_key;
756
757  /** The encoding that all strings are converted to as set during iterator
758   *  creation.
759   */
760  REGFI_ENCODING string_encoding;
761
762  /** Index of the current subkey */
763  uint32_t cur_subkey;
764
765  /** Index of the current value */
766  uint32_t cur_value;
767} REGFI_ITERATOR;
768
769
770typedef struct _regfi_iter_position
771{
772  REGFI_NK_REC* nk;
773  uint32_t cur_subkey;
774  /* We could store a cur_value here as well, but didn't see
775   * the use in it right now.
776   */
777} REGFI_ITER_POSITION;
778
779
780/** General purpose buffer with stored length
781 * @ingroup regfiBottomLayer
782 */
783typedef struct _regfi_buffer
784{
785  uint8_t* buf;
786  uint32_t len;
787} REGFI_BUFFER;
788
789
790
791/******************************************************************************/
792/**
793 * @defgroup regfiBase Base Layer: Essential Functions and Data Structures
794 *
795 * These functions are either necessary for normal use of the regfi API or just
796 * don't fit particularly well in any of the other layers.
797 */
798/******************************************************************************/
799
800/** Attempts to open a registry hive and allocate related data structures.
801 *
802 * @param filename A string containing the relative or absolute path of the
803 *               registry hive to be opened.
804 *
805 * @return A reference to a newly allocated REGFI_FILE structure,
806 *         if successful;  NULL on error.
807 *
808 * @ingroup regfiBase
809 */
810REGFI_FILE*           regfi_open(const char* filename);
811
812
813/** Parses file headers of an already open registry hive file and
814 *  allocates related structures for further parsing.
815 *
816 * @param fd A file descriptor of an already open file.  Must be seekable.
817 *
818 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
819 *         NULL on error.
820 *
821 * @ingroup regfiBase
822 */
823REGFI_FILE*           regfi_alloc(int fd);
824
825
826/** Closes and frees an open registry hive.
827 *
828 * @param file The registry structure to close.
829 *
830 * @return 0 on success, -1 on failure with errno set. 
831 *         errno codes are similar to those of close(2).
832 *
833 * @ingroup regfiBase
834 */
835int                   regfi_close(REGFI_FILE* file);
836
837
838/** Frees a hive's data structures without closing the underlying file.
839 *
840 * @param file The registry structure to free.
841 *
842 * @ingroup regfiBase
843 */
844void                  regfi_free(REGFI_FILE* file);
845
846
847/** Get errors, warnings, and/or verbose information relating to processing of
848 *  the given registry file.
849 *
850 * @param file the structure for the registry file
851 *
852 * @return A newly allocated char* which must be free()d by the caller.
853 *
854 * @ingroup regfiBase
855 */
856char*                 regfi_get_messages(REGFI_FILE* file);
857
858
859/** Set the verbosity level of errors and warnings generated by the library
860 *  (as accessible via regfi_get_messages).
861 *
862 * This may be called at any time and will take effect immediately.
863 *
864 * @param file   the structure for the registry file
865 *
866 * @param mask   an integer representing the types of messages desired.
867 *               Acceptable values are created through bitwise ORs of
868 *               REGFI_MSG_* values.  For instance, if only errors and
869 *               informational messages were desired (but not warnings),
870 *               then one would specify: REGFI_MSG_ERROR|REGFI_MSG_INFO
871 *               New REGFI_FILE structures are created with:
872 *                REGFI_MSG_ERROR|REGFI_MSG_WARN
873 *               Note that error and warning messages will continue to
874 *               accumulate in memory if they are not fetched using
875 *               regfi_get_messages and then freed by the caller.
876 *               To disable error messages entirely, supply 0, which
877 *               will prevent message accumulation. 
878 *
879 * @ingroup regfiBase
880 */
881void                  regfi_set_message_mask(REGFI_FILE* file, uint16_t mask);
882
883
884/* Dispose of previously parsed records */
885
886/** Frees a key structure previously returned by one of the API functions
887 *
888 * XXX: finish documenting
889 *
890 * @ingroup regfiBase
891 */
892void                  regfi_free_key(REGFI_NK_REC* nk);
893
894
895/** Frees a value structure previously returned by one of the API functions
896 *
897 * XXX: finish documenting
898 *
899 * @ingroup regfiBase
900 */
901void                  regfi_free_value(REGFI_VK_REC* vk);
902
903
904
905/******************************************************************************/
906/**
907 * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface
908 *
909 * This top layer of API functions provides an iterator interface which makes
910 * traversing registry data structures easy in both single-threaded and
911 * multi-threaded scenarios.
912 */
913/******************************************************************************/
914
915/** Creates a new iterator for the provided registry file.
916 *
917 * @param file The opened registry file the iterator should be created for.
918 *
919 * @param output_encoding Character encoding that strings should be returned in.
920 *                        Only supply the REGFI_ENCODING_* constants, as others
921 *                        will be rejected.
922 *                        The following values are currently accepted:
923 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
924 *                        REGFI_ENCODING_ASCII
925 *                        REGFI_ENCODING_UTF8
926 *
927 * @return A newly allocated REGFI_ITERATOR.
928 *         Must be free()d with regfi_iterator_free.
929 *
930 * @ingroup regfiIteratorLayer
931 */
932REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* file,
933                                         REGFI_ENCODING output_encoding);
934
935
936/** Frees a registry file iterator previously created by regfi_iterator_new.
937 *
938 * This does not affect the underlying registry file's allocation status.
939 *
940 * @param i the iterator to be freed
941 *
942 * @ingroup regfiIteratorLayer
943 */
944void                  regfi_iterator_free(REGFI_ITERATOR* i);
945
946
947/** Traverse deeper into the registry tree at the current subkey.
948 *
949 * @param i the iterator
950 *
951 * @return  true on success, false on failure. 
952 *          Note that subkey and value indexes are preserved.  That is, if a
953 *          regfi_iterator_up call occurs later (reversing the effect of this
954 *          call) then the subkey and value referenced prior to the
955 *          regfi_iterator_down call will still be referenced.  This  makes
956 *          depth-first iteration particularly easy.
957 *
958 * @ingroup regfiIteratorLayer
959 */
960bool                  regfi_iterator_down(REGFI_ITERATOR* i);
961
962
963/** Traverse up to the current key's parent key.
964 *
965 * @param i the iterator
966 *
967 * @return  true on success, false on failure.  Any subkey or value state
968 *          associated with the current key is lost.
969 *
970 * @ingroup regfiIteratorLayer
971 */
972bool                  regfi_iterator_up(REGFI_ITERATOR* i);
973
974
975/** Traverse up to the root key of the hive.
976 *
977 * @param i the iterator
978 *
979 * @return true on success, false on failure.
980 *
981 * @ingroup regfiIteratorLayer
982 */
983bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
984
985
986/** Traverse down multiple levels in the registry hive.
987 *
988 * XXX: This currently only accepts ASCII key names.  Need to look into
989 *      accepting other encodings.
990 *
991 * @param i    the iterator
992 * @param path a list of key names representing the path.  This list must
993 *             contain NUL terminated strings.  The list itself is
994 *             terminated with a NULL pointer.  All path elements must be
995 *             keys; value names are not accepted (even as the last
996 *             element).
997 *
998 * @return true on success, false on failure.  If any element of path is not
999 *                 found, false will be returned and the iterator will remain
1000 *                 in its original position.
1001 *
1002 * @ingroup regfiIteratorLayer
1003 */
1004bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
1005
1006
1007/** Returns the currently referenced key.
1008 *
1009 * @param i the iterator
1010 *
1011 * @return A read-only key structure for the current key, or NULL on failure.
1012 *
1013 * @ingroup regfiIteratorLayer
1014 */
1015const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
1016
1017
1018/** Returns the SK (security) record referenced by the current key.
1019 *
1020 * @param i the iterator
1021 *
1022 * @return A read-only SK structure, or NULL on failure.
1023 *
1024 * @ingroup regfiIteratorLayer
1025 */
1026const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
1027
1028
1029/** Sets the internal subkey index to the first subkey referenced by the current
1030 *  key and returns that key.
1031 *
1032 * @param i the iterator
1033 *
1034 * @return A newly allocated key structure for the newly referenced first
1035 *         subkey, or NULL on failure.  Failure may be due to a lack of any
1036 *         subkeys or other errors.  Newly allocated keys must be freed with
1037 *         regfi_free_key.
1038 *
1039 * @ingroup regfiIteratorLayer
1040 */
1041REGFI_NK_REC*         regfi_iterator_first_subkey(REGFI_ITERATOR* i);
1042
1043
1044/** Returns the currently indexed subkey.
1045 *
1046 * @param i the iterator
1047 *
1048 * @return A newly allocated key structure for the currently referenced subkey,
1049 *         or NULL on failure.  Newly allocated keys must be freed with
1050 *         regfi_free_key.
1051 *
1052 * @ingroup regfiIteratorLayer
1053 */
1054REGFI_NK_REC*         regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
1055
1056
1057/** Increments the internal subkey index to the next key in the subkey-list and
1058 *  returns the subkey for that index.
1059 *
1060 * @param i the iterator
1061 *
1062 * @return A newly allocated key structure for the next subkey or NULL on
1063 *         failure.  Newly allocated keys must be freed with regfi_free_key.
1064 *
1065 * @ingroup regfiIteratorLayer
1066 */
1067REGFI_NK_REC*         regfi_iterator_next_subkey(REGFI_ITERATOR* i);
1068
1069
1070/** Searches for a subkey with a given name under the current key.
1071 *
1072 * @param i           the iterator
1073 * @param subkey_name subkey name to search for
1074 *
1075 * @return True if such a subkey was found, false otherwise.  If a subkey is
1076 *         found, the current subkey index is set to that subkey.  Otherwise,
1077 *         the subkey index remains at the same location as before the call.
1078 *
1079 * @ingroup regfiIteratorLayer
1080 */
1081bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
1082                                                 const char* subkey_name);
1083
1084/** Sets the internal value index to the first value referenced by the current
1085 *  key and returns that value.
1086 *
1087 * @param i the iterator
1088 *
1089 * @return  A newly allocated value structure for the newly referenced first
1090 *          value, or NULL on failure.  Failure may be due to a lack of any
1091 *          values or other errors.  Newly allocated keys must be freed with
1092 *          regfi_free_value.
1093 *
1094 * @ingroup regfiIteratorLayer
1095 */
1096REGFI_VK_REC*         regfi_iterator_first_value(REGFI_ITERATOR* i);
1097
1098
1099/** Returns the currently indexed value.
1100 *
1101 * @param i the iterator
1102 *
1103 * @return A newly allocated value structure for the currently referenced value,
1104 *         or NULL on failure.  Newly allocated values must be freed with
1105 *         regfi_free_value.
1106 *
1107 * @ingroup regfiIteratorLayer
1108 */
1109REGFI_VK_REC*         regfi_iterator_cur_value(REGFI_ITERATOR* i);
1110
1111
1112/** Increments the internal value index to the next value in the value-list and
1113 *  returns the value for that index.
1114 *
1115 * @param i the iterator
1116 *
1117 * @return  A newly allocated key structure for the next value or NULL on
1118 *          failure.  Newly allocated keys must be freed with regfi_free_value.
1119 *
1120 * @ingroup regfiIteratorLayer
1121 */
1122REGFI_VK_REC*         regfi_iterator_next_value(REGFI_ITERATOR* i);
1123
1124
1125/** Searches for a value with a given name under the current key.
1126 *
1127 * @param i          the iterator
1128 * @param value_name value name to search for
1129 *
1130 * @return True if such a value was found, false otherwise.  If a value is
1131 *         found, the current value index is set to that value.  Otherwise,
1132 *         the value index remains at the same location as before the call.
1133 *
1134 * @ingroup regfiIteratorLayer
1135 */
1136bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
1137                                                const char* value_name);
1138
1139/** Retrieves classname for a given key.
1140 *
1141 * @param i   the iterator
1142 * @param key the key whose classname is desired
1143 *
1144 * @return Returns a newly allocated classname structure, or NULL on failure.
1145 *         Classname structures must be freed with regfi_free_classname.
1146 *
1147 * @ingroup regfiIteratorLayer
1148 */
1149REGFI_CLASSNAME*      regfi_iterator_fetch_classname(REGFI_ITERATOR* i, 
1150                                                     const REGFI_NK_REC* key);
1151
1152
1153/** Retrieves data for a given value.
1154 *
1155 * @param i     the iterator
1156 * @param value the value whose data is desired
1157 *
1158 * @return Returns a newly allocated data structure, or NULL on failure.
1159 *         Data structures must be freed with regfi_free_data.
1160 *
1161 * @ingroup regfiIteratorLayer
1162 */
1163REGFI_DATA*           regfi_iterator_fetch_data(REGFI_ITERATOR* i, 
1164                                                const REGFI_VK_REC* value);
1165
1166
1167
1168/******************************************************************************/
1169/**
1170 * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading
1171 */
1172/******************************************************************************/
1173
1174/** Loads a key at a given file offset along with associated data structures.
1175 *
1176 * XXX: finish documenting
1177 *
1178 * @ingroup regfiGlueLayer
1179 */
1180REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32_t offset, 
1181                                     REGFI_ENCODING output_encoding, 
1182                                     bool strict);
1183
1184
1185/** Loads a value at a given file offset alng with associated data structures.
1186 *
1187 * XXX: finish documenting
1188 *
1189 * @ingroup regfiGlueLayer
1190 */
1191REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32_t offset, 
1192                                       REGFI_ENCODING output_encoding, 
1193                                       bool strict);
1194
1195
1196/** Loads a logical subkey list in its entirety which may span multiple records.
1197 *
1198 * XXX: finish documenting
1199 *
1200 * @ingroup regfiGlueLayer
1201 */
1202REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
1203                                            uint32_t num_keys, uint32_t max_size,
1204                                            bool strict);
1205
1206
1207/** Loads a valuelist.
1208 *
1209 * XXX: finish documenting
1210 *
1211 * @ingroup regfiGlueLayer
1212 */
1213REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, 
1214                                           uint32_t num_values, uint32_t max_size,
1215                                           bool strict);
1216
1217
1218/** Loads a data record which may be contained in the virtual offset, in a
1219 *  single cell, or in multiple cells through big data records.
1220 *
1221 * XXX: finish documenting
1222 *
1223 * @ingroup regfiGlueLayer
1224 */
1225REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32_t voffset,
1226                                      uint32_t length, bool data_in_offset,
1227                                      bool strict);
1228
1229
1230/** Loads the data associated with a big data record at the specified offset.
1231 *
1232 * XXX: finish documenting
1233 *
1234 * @ingroup regfiGlueLayer
1235 */
1236REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32_t offset, 
1237                                          uint32_t data_length,uint32_t cell_length,
1238                                          range_list* used_ranges,
1239                                          bool strict);
1240
1241
1242/** Given raw data, attempts to interpret the data based on a specified registry
1243 *  data type.
1244 *
1245 * XXX: finish documenting
1246 *
1247 * @ingroup regfiGlueLayer
1248 */
1249bool                  regfi_interpret_data(REGFI_FILE* file, 
1250                                           REGFI_ENCODING string_encoding,
1251                                           uint32_t type, REGFI_DATA* data);
1252
1253
1254/** Frees the memory associated with a REGFI_CLASSNAME data structure.
1255 *
1256 * XXX: finish documenting
1257 *
1258 * @ingroup regfiGlueLayer
1259 */
1260void                  regfi_free_classname(REGFI_CLASSNAME* classname);
1261
1262
1263/** Frees the memory associated with a REGFI_DATA data structure.
1264 *
1265 * XXX: finish documenting
1266 *
1267 * @ingroup regfiGlueLayer
1268 */
1269void                  regfi_free_data(REGFI_DATA* data);
1270
1271
1272/* These are cached so return values don't need to be freed. */
1273
1274/** Loads an "sk" security record at the specified offset.
1275 *
1276 * XXX: finish documenting
1277 *
1278 * @ingroup regfiGlueLayer
1279 */
1280const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32_t offset,
1281                                    bool strict);
1282
1283
1284/** Retrieves the HBIN data structure stored at the specified offset.
1285 *
1286 * XXX: finish documenting
1287 *
1288 * @ingroup regfiGlueLayer
1289 */
1290const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
1291
1292
1293
1294/******************************************************************************/
1295/**
1296 * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access
1297 */
1298/******************************************************************************/
1299
1300REGFI_FILE*           regfi_parse_regf(int fd, bool strict);
1301REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, 
1302                                       bool strict);
1303
1304
1305/** Parses an NK record at the specified offset
1306 *
1307 * @param file     the registry file structure
1308 * @param offset   the offset of the cell (not the record) to be parsed.
1309 * @param max_size the maximum size the NK cell could be. (for validation)
1310 * @param strict   if true, rejects any malformed records.  Otherwise,
1311 *                 tries to minimally validate integrity.
1312 *
1313 * @return A newly allocated NK record structure, or NULL on failure.
1314 *
1315 * @ingroup regfiParseLayer
1316 */
1317REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
1318                                     uint32_t max_size, bool strict);
1319
1320
1321/** Parses a single cell containing a subkey-list record.
1322 *
1323 * XXX: finish documenting
1324 *
1325 * @ingroup regfiParseLayer
1326 */
1327REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
1328                                             uint32_t max_size, bool strict);
1329
1330
1331/** Parses a VK (value) record at the specified offset
1332 *
1333 * XXX: finish documenting
1334 *
1335 * @ingroup regfiParseLayer
1336 */
1337REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32_t offset, 
1338                                     uint32_t max_size, bool strict);
1339
1340
1341/** Parses an SK (security) record at the specified offset
1342 *
1343 * XXX: finish documenting
1344 *
1345 * @ingroup regfiParseLayer
1346 */
1347REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32_t offset, 
1348                                     uint32_t max_size, bool strict);
1349
1350
1351/** Retrieves information on all cells in the registry hive which are
1352 *  currently in the unallocated status. 
1353 *
1354 * The unallocated status is determined based soley on the cell length sign.
1355 *
1356 * XXX: finish documenting
1357 *
1358 * @ingroup regfiParseLayer
1359 */
1360range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
1361
1362
1363/** Helper function to parse a cell
1364 *
1365 * XXX: finish documenting
1366 *
1367 * @ingroup regfiParseLayer
1368 */
1369bool                  regfi_parse_cell(int fd, uint32_t offset, 
1370                                       uint8_t* hdr, uint32_t hdr_len,
1371                                       uint32_t* cell_length, bool* unalloc);
1372
1373
1374/** Parses a classname cell
1375 *
1376 * XXX: finish documenting
1377 *
1378 * @ingroup regfiParseLayer
1379 */
1380uint8_t*                regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
1381                                            uint16_t* name_length, 
1382                                            uint32_t max_size, bool strict);
1383
1384
1385/** Parses a single-cell data record
1386 *
1387 * XXX: finish documenting
1388 *
1389 * @ingroup regfiParseLayer
1390 */
1391REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32_t offset,
1392                                       uint32_t length, bool strict);
1393
1394
1395/** Parses a "little data" record which is stored entirely within the
1396 *  provided virtual offset.
1397 *
1398 * XXX: finish documenting
1399 *
1400 * @ingroup regfiParseLayer
1401 */
1402REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, 
1403                                              uint32_t length, bool strict);
1404
1405
1406/******************************************************************************/
1407/*    Private Functions                                                       */
1408/******************************************************************************/
1409REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file, 
1410                                    REGFI_ENCODING output_encoding);
1411void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
1412uint32_t              regfi_read(int fd, uint8_t* buf, uint32_t* length);
1413
1414const char*           regfi_type_val2str(unsigned int val);
1415int                   regfi_type_str2val(const char* str);
1416
1417char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
1418char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
1419char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
1420char*                 regfi_get_group(WINSEC_DESC* sec_desc);
1421
1422REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists, 
1423                                              REGFI_SUBKEY_LIST** lists,
1424                                              bool strict);
1425REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1426                                                uint32_t max_size, bool strict,
1427                                                uint8_t depth_left);
1428void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type, 
1429                                        const char* fmt, ...);
1430REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
1431REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
1432int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1433int32_t               regfi_conv_charset(const char* input_charset, 
1434                                         const char* output_charset,
1435                                         uint8_t* input, char* output, 
1436                                         uint32_t input_len, uint32_t output_max);
1437REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
1438
1439/* XXX: move to base API and document */
1440void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
1441time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
1442
1443
1444void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk, 
1445                             REGFI_ENCODING output_encoding, bool strict);
1446void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk, 
1447                               REGFI_ENCODING output_encoding, bool strict);
1448
1449
1450#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.