source: trunk/include/regfi.h @ 103

Last change on this file since 103 was 103, checked in by tim, 16 years ago

rewrote value list parsing routine
  • Property svn:keywords set to Id
File size: 11.5 KB
Line 
1/*
2 * Branched from Samba project, Subversion repository version #6903:
3 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Unix SMB/CIFS implementation.
6 * Windows NT registry I/O library
7 *
8 * Copyright (C) 2005-2008 Timothy D. Morgan
9 * Copyright (C) 2005 Gerald (Jerry) Carter
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; version 2 of the License.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 *
24 * $Id: regfi.h 103 2008-04-03 19:45:41Z tim $
25 */
26
27/************************************************************
28 * Most of this information was obtained from
29 * http://www.wednesday.demon.co.uk/dosreg.html
30 * Thanks Nigel!
31 ***********************************************************/
32
33#ifndef _REGFI_H
34#define _REGFI_H
35
36#include <stdlib.h>
37#include <stdio.h>
38#include <stdbool.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "void_stack.h"
50#include "range_list.h"
51
52/******************************************************************************/
53/* Macros */
54 
55/* Registry data types */
56#define REG_NONE                       0
57#define REG_SZ                         1
58#define REG_EXPAND_SZ                  2
59#define REG_BINARY                     3
60#define REG_DWORD                      4
61#define REG_DWORD_LE                   4  /* DWORD, little endian */
62#define REG_DWORD_BE                   5  /* DWORD, big endian */
63#define REG_LINK                       6
64#define REG_MULTI_SZ                   7
65#define REG_RESOURCE_LIST              8
66#define REG_FULL_RESOURCE_DESCRIPTOR   9
67#define REG_RESOURCE_REQUIREMENTS_LIST 10
68#define REG_QWORD                      11 /* 64-bit little endian */
69/* XXX: Has MS defined a REG_QWORD_BE? */
70/* Not a real type in the registry */
71#define REG_KEY                        0x7FFFFFFF
72
73
74#define REGF_BLOCKSIZE          0x1000
75#define REGF_ALLOC_BLOCK        0x1000  /* Minimum allocation unit for hbins */
76#define REGF_MAX_DEPTH          512
77
78/* header sizes for various records */
79
80#define REGF_MAGIC_SIZE         4
81#define HBIN_MAGIC_SIZE         4
82#define HBIN_HEADER_REC_SIZE    0x20
83#define REC_HDR_SIZE            2
84
85#define REGF_OFFSET_NONE        0xffffffff
86#define REGFI_NK_MIN_LENGTH     0x4C
87#define REGFI_VK_MIN_LENGTH     0x14
88#define REGFI_SK_MIN_LENGTH     0x14
89
90/* Flags for the vk records */
91
92#define VK_FLAG_NAME_PRESENT    0x0001
93#define VK_DATA_IN_OFFSET       0x80000000
94#define VK_MAX_DATA_LENGTH      1024*1024
95
96/* NK record macros */
97
98#define NK_TYPE_LINKKEY         0x0010
99#define NK_TYPE_NORMALKEY       0x0020
100#define NK_TYPE_ROOTKEY         0x002c
101  /* TODO: Unknown type that shows up in Vista registries */
102#define NK_TYPE_UNKNOWN1         0x1020
103
104#define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ };
105/* if the count == 0; we can clean up */
106#define HBIN_REMOVE_REF(x, y){ x->hbin = NULL; y->ref_count-- };
107
108
109/* HBIN block */
110struct regf_hbin;
111typedef struct regf_hbin
112{
113  struct regf_hbin* prev;
114  struct regf_hbin* next;
115  uint32 file_off;       /* my offset in the registry file */
116  uint32 ref_count;      /* how many active records are pointing to this
117                          * block (not used currently)
118                          */
119 
120  uint32 first_hbin_off; /* offset from first hbin block */
121  uint32 block_size;     /* block size of this block
122                          * Should be a multiple of 4096 (0x1000)
123                          */
124  uint32 next_block;     /* relative offset to next block. 
125                          * NOTE: This value may be unreliable!
126                          */
127
128  uint8 magic[HBIN_MAGIC_SIZE]; /* "hbin" */
129  prs_struct ps;         /* data */
130} REGF_HBIN;
131
132
133/* Hash List -- list of key offsets and hashed names for consistency */
134typedef struct 
135{
136  uint32 nk_off;
137  uint8 keycheck[4];
138} REGF_HASH_REC;
139
140
141typedef struct 
142{
143  REGF_HBIN* hbin;       /* pointer to HBIN record (in memory) containing
144                          * this nk record
145                          */
146  REGF_HASH_REC* hashes;
147  uint32 hbin_off;       /* offset from beginning of this hbin block */
148  uint32 cell_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
149 
150  uint8 header[REC_HDR_SIZE];
151  uint16 num_keys;
152} REGF_LF_REC;
153
154
155/* Key Value */
156typedef struct 
157{
158  uint32 offset;        /* Real offset of this record's cell in the file */
159  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
160
161  REGF_HBIN* hbin;      /* pointer to HBIN record (in memory) containing
162                         * this nk record
163                         */
164  uint8* data;
165  uint16 name_length;
166  char*  valuename;
167  uint32 hbin_off;      /* offset from beginning of this hbin block */
168 
169  uint32 data_size;
170  uint32 data_off;      /* offset of data cell (virtual) */
171  uint32 type;
172  uint8  magic[REC_HDR_SIZE];
173  uint16 flag;
174  uint16 unknown1;
175} REGF_VK_REC;
176
177
178/* Key Security */
179struct _regf_sk_rec;
180
181typedef struct _regf_sk_rec
182{
183  struct _regf_sk_rec* next;
184  struct _regf_sk_rec* prev;
185  REGF_HBIN* hbin;      /* pointer to HBIN record (in memory) containing
186                         * this nk record
187                         */
188  SEC_DESC* sec_desc;
189  uint32 hbin_off;      /* offset from beginning of this hbin block */
190  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
191  uint32 offset;        /* Real file offset of this record */
192 
193  uint32 sk_off;        /* offset parsed from NK record used as a key
194                         * to lookup reference to this SK record
195                         */
196 
197  uint32 prev_sk_off;
198  uint32 next_sk_off;
199  uint32 ref_count;
200  uint32 desc_size;     /* size of security descriptor */
201  uint16 unknown_tag;
202  uint8  magic[REC_HDR_SIZE];
203} REGF_SK_REC;
204
205
206/* Key Name */ 
207typedef struct 
208{
209  uint32 offset;        /* Real offset of this record's cell in the file */
210  uint32 cell_size;     /* Actual or estimated length of the cell. 
211                         * Always in multiples of 8.
212                         */
213
214  /* link in the other records here */
215  REGF_VK_REC** values;
216  REGF_SK_REC* sec_desc;
217  REGF_LF_REC subkeys;
218 
219  /* header information */
220  /* XXX: should we be looking for types other than the root key type? */
221  uint16 key_type;     
222  uint8  magic[REC_HDR_SIZE];
223  NTTIME mtime;
224  uint16 name_length;
225  uint16 classname_length;
226  char* classname;
227  char* keyname;
228  uint32 parent_off;    /* back pointer in registry hive */
229  uint32 classname_off; 
230 
231  /* max lengths */
232  uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
233  uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
234  uint32 max_bytes_valuename;       /* max valuename * 2 */
235  uint32 max_bytes_value;           /* max value data size */
236 
237  /* unknowns */
238  uint32 unknown1;
239  uint32 unknown2;
240  uint32 unknown3;
241  uint32 unk_index;                 /* nigel says run time index ? */
242 
243  /* children */
244  uint32 num_subkeys;
245  uint32 subkeys_off;   /* hash records that point to NK records */     
246  uint32 num_values;
247  uint32 values_off;    /* value lists which point to VK records */
248  uint32 sk_off;        /* offset to SK record */ 
249} REGF_NK_REC;
250
251
252
253/* REGF block */
254typedef struct 
255{
256  /* run time information */
257  int fd;         /* file descriptor */
258  /* For sanity checking (not part of the registry header) */
259  uint32 file_length;
260  void* mem_ctx;  /* memory context for run-time file access information */
261  REGF_HBIN* block_list; /* list of open hbin blocks */
262
263  /* Experimental hbin lists */
264  range_list* hbins;
265  range_list* unalloc_cells;
266
267  /* file format information */
268  REGF_SK_REC* sec_desc_list;   /* list of security descriptors referenced
269                                 * by NK records
270                                 */
271 
272  uint8  magic[REGF_MAGIC_SIZE];/* "regf" */
273  NTTIME mtime;
274  uint32 data_offset;           /* offset to record in the first (or any?)
275                                 * hbin block
276                                 */
277  uint32 last_block;            /* offset to last hbin block in file */
278
279  uint32 checksum;              /* Stored checksum. */
280  uint32 computed_checksum;     /* Our own calculation of the checksum.
281                                 * (XOR of bytes 0x0000 - 0x01FB)
282                                 */
283 
284  /* unknown data structure values */
285  uint32 unknown1;
286  uint32 unknown2;
287  uint32 unknown3;
288  uint32 unknown4;
289  uint32 unknown5;
290  uint32 unknown6;
291  uint32 unknown7;
292} REGF_FILE;
293
294
295
296typedef struct 
297{
298  REGF_FILE* f;
299  void_stack* key_positions;
300  REGF_NK_REC* cur_key;
301  uint32 cur_subkey;
302  uint32 cur_value;
303} REGFI_ITERATOR;
304
305
306typedef struct 
307{
308  REGF_NK_REC* nk;
309  uint32 cur_subkey;
310  /* We could store a cur_value here as well, but didn't see
311   * the use in it right now.
312   */
313} REGFI_ITER_POSITION;
314
315
316/******************************************************************************/
317/* Function Declarations */
318/*  Main API */
319const char*           regfi_type_val2str(unsigned int val);
320int                   regfi_type_str2val(const char* str);
321
322char*                 regfi_get_sacl(SEC_DESC* sec_desc);
323char*                 regfi_get_dacl(SEC_DESC* sec_desc);
324char*                 regfi_get_owner(SEC_DESC* sec_desc);
325char*                 regfi_get_group(SEC_DESC* sec_desc);
326
327REGF_FILE*            regfi_open(const char* filename);
328int                   regfi_close(REGF_FILE* r);
329
330REGFI_ITERATOR*       regfi_iterator_new(REGF_FILE* fh);
331void                  regfi_iterator_free(REGFI_ITERATOR* i);
332bool                  regfi_iterator_down(REGFI_ITERATOR* i);
333bool                  regfi_iterator_up(REGFI_ITERATOR* i);
334bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
335
336bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
337                                                 const char* subkey_name);
338bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i, 
339                                               const char** path);
340const REGF_NK_REC*    regfi_iterator_cur_key(REGFI_ITERATOR* i);
341const REGF_NK_REC*    regfi_iterator_first_subkey(REGFI_ITERATOR* i);
342const REGF_NK_REC*    regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
343const REGF_NK_REC*    regfi_iterator_next_subkey(REGFI_ITERATOR* i);
344
345bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
346                                                const char* value_name);
347const REGF_VK_REC*    regfi_iterator_first_value(REGFI_ITERATOR* i);
348const REGF_VK_REC*    regfi_iterator_cur_value(REGFI_ITERATOR* i);
349const REGF_VK_REC*    regfi_iterator_next_value(REGFI_ITERATOR* i);
350
351/************************************/
352/*  Low-layer data structure access */
353/************************************/
354REGF_FILE*            regfi_parse_regf(int fd, bool strict);
355REGF_HBIN*            regfi_parse_hbin(REGF_FILE* file, uint32 offset, 
356                                       bool strict, bool save_unalloc);
357
358
359/* regfi_parse_nk: Parses an NK record.
360 *
361 * Arguments:
362 *   f        -- the registry file structure
363 *   offset   -- the offset of the cell (not the record) to be parsed.
364 *   max_size -- the maximum size the NK cell could be. (for validation)
365 *   strict   -- if true, rejects any malformed records.  Otherwise,
366 *               tries to minimally validate integrity.
367 * Returns:
368 *   A newly allocated NK record structure, or NULL on failure.
369 */
370REGF_NK_REC*          regfi_parse_nk(REGF_FILE* file, uint32 offset, 
371                                     uint32 max_size, bool strict);
372
373
374/* Private Functions */
375REGF_NK_REC*          regfi_rootkey(REGF_FILE* file);
376void                  regfi_key_free(REGF_NK_REC* nk);
377uint32                regfi_read(int fd, uint8* buf, uint32* length);
378
379
380
381/****************/
382/* Experimental */
383/****************/
384
385REGF_VK_REC** regfi_load_valuelist(REGF_FILE* file, uint32 offset, 
386                                   uint32 num_values);
387
388REGF_VK_REC* regfi_parse_vk(REGF_FILE* file, uint32 offset, 
389                            uint32 max_size, bool strict);
390
391uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, 
392                        uint32 length, bool strict);
393
394
395
396#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.