Context Navigation

source: trunk/include/regfi.h @ 105

Last change on this file since 105 was 105, checked in by tim, 16 years ago
fully removed dependence on Samba parse structures from core library
Property svn:keywords set to `Id`
File size: 11.9 KB

Line
1	/*
2	* Branched from Samba project, Subversion repository version #6903:
3	* http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4	*
5	* Unix SMB/CIFS implementation.
6	* Windows NT registry I/O library
7	*
8	* Copyright (C) 2005-2008 Timothy D. Morgan
9	* Copyright (C) 2005 Gerald (Jerry) Carter
10	*
11	* This program is free software; you can redistribute it and/or modify
12	* it under the terms of the GNU General Public License as published by
13	* the Free Software Foundation; version 2 of the License.
14	*
15	* This program is distributed in the hope that it will be useful,
16	* but WITHOUT ANY WARRANTY; without even the implied warranty of
17	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18	* GNU General Public License for more details.
19	*
20	* You should have received a copy of the GNU General Public License
21	* along with this program; if not, write to the Free Software
22	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23	*
24	* $Id: regfi.h 105 2008-04-14 04:55:41Z tim $
25	*/
26
27	/************************************************************
28	* Most of this information was obtained from
29	* http://www.wednesday.demon.co.uk/dosreg.html
30	* Thanks Nigel!
31	***********************************************************/
32
33	#ifndef _REGFI_H
34	#define _REGFI_H
35
36	#include <stdlib.h>
37	#include <stdio.h>
38	#include <stdbool.h>
39	#include <string.h>
40	#include <errno.h>
41	#include <time.h>
42	#include <fcntl.h>
43	#include <sys/stat.h>
44	#include <sys/types.h>
45	#include <unistd.h>
46	#include <assert.h>
47
48	#include "smb_deps.h"
49	#include "void_stack.h"
50	#include "range_list.h"
51
52	/******************************************************************************/
53	/* Macros */
54
55	/* Registry data types */
56	#define REG_NONE 0
57	#define REG_SZ 1
58	#define REG_EXPAND_SZ 2
59	#define REG_BINARY 3
60	#define REG_DWORD 4
61	#define REG_DWORD_LE 4 /* DWORD, little endian */
62	#define REG_DWORD_BE 5 /* DWORD, big endian */
63	#define REG_LINK 6
64	#define REG_MULTI_SZ 7
65	#define REG_RESOURCE_LIST 8
66	#define REG_FULL_RESOURCE_DESCRIPTOR 9
67	#define REG_RESOURCE_REQUIREMENTS_LIST 10
68	#define REG_QWORD 11 /* 64-bit little endian */
69	/* XXX: Has MS defined a REG_QWORD_BE? */
70	/* Not a real type in the registry */
71	#define REG_KEY 0x7FFFFFFF
72
73
74	#define REGF_BLOCKSIZE 0x1000
75	#define REGF_ALLOC_BLOCK 0x1000 /* Minimum allocation unit for hbins */
76	#define REGF_MAX_DEPTH 512
77
78	/* header sizes for various records */
79
80	#define REGF_MAGIC_SIZE 4
81	#define HBIN_MAGIC_SIZE 4
82	#define HBIN_HEADER_REC_SIZE 0x20
83	#define REC_HDR_SIZE 2
84
85	#define REGF_OFFSET_NONE 0xffffffff
86	#define REGFI_NK_MIN_LENGTH 0x4C
87	#define REGFI_VK_MIN_LENGTH 0x14
88	#define REGFI_SK_MIN_LENGTH 0x14
89	#define REGFI_HASH_LIST_MIN_LENGTH 0x4
90
91	/* Flags for the vk records */
92
93	#define VK_FLAG_NAME_PRESENT 0x0001
94	#define VK_DATA_IN_OFFSET 0x80000000
95	#define VK_MAX_DATA_LENGTH 1024*1024
96
97	/* NK record macros */
98
99	#define NK_TYPE_LINKKEY 0x0010
100	#define NK_TYPE_NORMALKEY 0x0020
101	#define NK_TYPE_ROOTKEY 0x002c
102	/* TODO: Unknown type that shows up in Vista registries */
103	#define NK_TYPE_UNKNOWN1 0x1020
104
105	#define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ };
106	/* if the count == 0; we can clean up */
107	#define HBIN_REMOVE_REF(x, y){ x->hbin = NULL; y->ref_count-- };
108
109
110	/* HBIN block */
111	struct regf_hbin;
112	typedef struct regf_hbin
113	{
114	struct regf_hbin* prev;
115	struct regf_hbin* next;
116	uint32 file_off; /* my offset in the registry file */
117	uint32 ref_count; /* how many active records are pointing to this
118	* block (not used currently)
119	*/
120
121	uint32 first_hbin_off; /* offset from first hbin block */
122	uint32 block_size; /* block size of this block
123	* Should be a multiple of 4096 (0x1000)
124	*/
125	uint32 next_block; /* relative offset to next block.
126	* NOTE: This value may be unreliable!
127	*/
128
129	uint8 magic[HBIN_MAGIC_SIZE]; /* "hbin" */
130	} REGF_HBIN;
131
132
133	/* Hash List -- list of key offsets and hashed names for consistency */
134	typedef struct
135	{
136	uint32 nk_off;
137	uint32 hash;
138	} REGF_HASH_LIST_ELEM;
139
140
141	typedef struct
142	{
143	uint32 offset; /* Real offset of this record's cell in the file */
144	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
145	REGF_HBIN* hbin; /* pointer to HBIN record (in memory) containing
146	* this nk record
147	*/
148	uint32 hbin_off; /* offset from beginning of this hbin block */
149	REGF_HASH_LIST_ELEM* hashes;
150
151	uint8 magic[REC_HDR_SIZE];
152	uint16 num_keys;
153	} REGF_HASH_LIST;
154
155
156	/* Key Value */
157	typedef struct
158	{
159	uint32 offset; /* Real offset of this record's cell in the file */
160	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
161
162	REGF_HBIN* hbin; /* pointer to HBIN record (in memory) containing
163	* this nk record
164	*/
165	uint8* data;
166	uint16 name_length;
167	char* valuename;
168	uint32 hbin_off; /* offset from beginning of this hbin block */
169
170	uint32 data_size;
171	uint32 data_off; /* offset of data cell (virtual) */
172	uint32 type;
173	uint8 magic[REC_HDR_SIZE];
174	uint16 flag;
175	uint16 unknown1;
176	} REGF_VK_REC;
177
178
179	/* Key Security */
180	struct _regf_sk_rec;
181
182	typedef struct _regf_sk_rec
183	{
184	struct _regf_sk_rec* next;
185	struct _regf_sk_rec* prev;
186	REGF_HBIN* hbin; /* pointer to HBIN record (in memory) containing
187	* this nk record
188	*/
189	SEC_DESC* sec_desc;
190	uint32 hbin_off; /* offset from beginning of this hbin block */
191	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
192	uint32 offset; /* Real file offset of this record */
193
194	uint32 sk_off; /* offset parsed from NK record used as a key
195	* to lookup reference to this SK record
196	*/
197
198	uint32 prev_sk_off;
199	uint32 next_sk_off;
200	uint32 ref_count;
201	uint32 desc_size; /* size of security descriptor */
202	uint16 unknown_tag;
203	uint8 magic[REC_HDR_SIZE];
204	} REGF_SK_REC;
205
206
207	/* Key Name */
208	typedef struct
209	{
210	uint32 offset; /* Real offset of this record's cell in the file */
211	uint32 cell_size; /* Actual or estimated length of the cell.
212	* Always in multiples of 8.
213	*/
214
215	/* link in the other records here */
216	REGF_VK_REC** values;
217	REGF_SK_REC* sec_desc;
218	REGF_HASH_LIST* subkeys;
219
220	/* header information */
221	/* XXX: should we be looking for types other than the root key type? */
222	uint16 key_type;
223	uint8 magic[REC_HDR_SIZE];
224	NTTIME mtime;
225	uint16 name_length;
226	uint16 classname_length;
227	char* classname;
228	char* keyname;
229	uint32 parent_off; /* back pointer in registry hive */
230	uint32 classname_off;
231
232	/* max lengths */
233	uint32 max_bytes_subkeyname; /* max subkey name * 2 */
234	uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
235	uint32 max_bytes_valuename; /* max valuename * 2 */
236	uint32 max_bytes_value; /* max value data size */
237
238	/* unknowns */
239	uint32 unknown1;
240	uint32 unknown2;
241	uint32 unknown3;
242	uint32 unk_index; /* nigel says run time index ? */
243
244	/* children */
245	uint32 num_subkeys;
246	uint32 subkeys_off; /* hash records that point to NK records */
247	uint32 num_values;
248	uint32 values_off; /* value lists which point to VK records */
249	uint32 sk_off; /* offset to SK record */
250	} REGF_NK_REC;
251
252
253
254	/* REGF block */
255	typedef struct
256	{
257	/* run time information */
258	int fd; /* file descriptor */
259	/* For sanity checking (not part of the registry header) */
260	uint32 file_length;
261	void* mem_ctx; /* memory context for run-time file access information */
262	REGF_HBIN* block_list; /* list of open hbin blocks */
263
264	/* Experimental hbin lists */
265	range_list* hbins;
266	range_list* unalloc_cells;
267
268	/* file format information */
269	REGF_SK_REC* sec_desc_list; /* list of security descriptors referenced
270	* by NK records
271	*/
272
273	uint8 magic[REGF_MAGIC_SIZE];/* "regf" */
274	NTTIME mtime;
275	uint32 data_offset; /* offset to record in the first (or any?)
276	* hbin block
277	*/
278	uint32 last_block; /* offset to last hbin block in file */
279
280	uint32 checksum; /* Stored checksum. */
281	uint32 computed_checksum; /* Our own calculation of the checksum.
282	* (XOR of bytes 0x0000 - 0x01FB)
283	*/
284
285	/* unknown data structure values */
286	uint32 unknown1;
287	uint32 unknown2;
288	uint32 unknown3;
289	uint32 unknown4;
290	uint32 unknown5;
291	uint32 unknown6;
292	uint32 unknown7;
293	} REGF_FILE;
294
295
296
297	typedef struct
298	{
299	REGF_FILE* f;
300	void_stack* key_positions;
301	REGF_NK_REC* cur_key;
302	uint32 cur_subkey;
303	uint32 cur_value;
304	} REGFI_ITERATOR;
305
306
307	typedef struct
308	{
309	REGF_NK_REC* nk;
310	uint32 cur_subkey;
311	/* We could store a cur_value here as well, but didn't see
312	* the use in it right now.
313	*/
314	} REGFI_ITER_POSITION;
315
316
317	/******************************************************************************/
318	/* Function Declarations */
319	/* Main API */
320	const char* regfi_type_val2str(unsigned int val);
321	int regfi_type_str2val(const char* str);
322
323	char* regfi_get_sacl(SEC_DESC* sec_desc);
324	char* regfi_get_dacl(SEC_DESC* sec_desc);
325	char* regfi_get_owner(SEC_DESC* sec_desc);
326	char* regfi_get_group(SEC_DESC* sec_desc);
327
328	REGF_FILE* regfi_open(const char* filename);
329	int regfi_close(REGF_FILE* r);
330
331	REGFI_ITERATOR* regfi_iterator_new(REGF_FILE* fh);
332	void regfi_iterator_free(REGFI_ITERATOR* i);
333	bool regfi_iterator_down(REGFI_ITERATOR* i);
334	bool regfi_iterator_up(REGFI_ITERATOR* i);
335	bool regfi_iterator_to_root(REGFI_ITERATOR* i);
336
337	bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
338	const char* subkey_name);
339	bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
340	const char** path);
341	const REGF_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
342	const REGF_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
343	const REGF_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
344	const REGF_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
345
346	bool regfi_iterator_find_value(REGFI_ITERATOR* i,
347	const char* value_name);
348	const REGF_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
349	const REGF_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
350	const REGF_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
351
352	/************************************/
353	/* Low-layer data structure access */
354	/************************************/
355	REGF_FILE* regfi_parse_regf(int fd, bool strict);
356	REGF_HBIN* regfi_parse_hbin(REGF_FILE* file, uint32 offset,
357	bool strict, bool save_unalloc);
358
359
360	/* regfi_parse_nk: Parses an NK record.
361	*
362	* Arguments:
363	* f -- the registry file structure
364	* offset -- the offset of the cell (not the record) to be parsed.
365	* max_size -- the maximum size the NK cell could be. (for validation)
366	* strict -- if true, rejects any malformed records. Otherwise,
367	* tries to minimally validate integrity.
368	* Returns:
369	* A newly allocated NK record structure, or NULL on failure.
370	*/
371	REGF_NK_REC* regfi_parse_nk(REGF_FILE* file, uint32 offset,
372	uint32 max_size, bool strict);
373
374
375	/* Private Functions */
376	REGF_NK_REC* regfi_rootkey(REGF_FILE* file);
377	void regfi_key_free(REGF_NK_REC* nk);
378	uint32 regfi_read(int fd, uint8* buf, uint32* length);
379
380
381
382	/****************/
383	/* Experimental */
384	/****************/
385	REGF_NK_REC* regfi_load_key(REGF_FILE* file, uint32 offset, bool strict);
386
387	REGF_HASH_LIST* regfi_load_hashlist(REGF_FILE* file, uint32 offset,
388	uint32 num_keys, uint32 max_size,
389	bool strict);
390
391	REGF_VK_REC** regfi_load_valuelist(REGF_FILE* file, uint32 offset,
392	uint32 num_values, uint32 max_size,
393	bool strict);
394
395	REGF_VK_REC* regfi_parse_vk(REGF_FILE* file, uint32 offset,
396	uint32 max_size, bool strict);
397
398	uint8* regfi_parse_data(REGF_FILE* file, uint32 offset,
399	uint32 length, bool strict);
400
401
402	#endif /* _REGFI_H */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: