source: trunk/include/regfi.h @ 132

Last change on this file since 132 was 132, checked in by tim, 15 years ago

separated ACL parsing code from smb_deps into new winsec library
  • Property svn:keywords set to Id
File size: 12.7 KB
Line 
1/*
2 * Branched from Samba project, Subversion repository version #6903:
3 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Unix SMB/CIFS implementation.
6 * Windows NT registry I/O library
7 *
8 * Copyright (C) 2005-2009 Timothy D. Morgan
9 * Copyright (C) 2005 Gerald (Jerry) Carter
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; version 2 of the License.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 *
24 * $Id: regfi.h 132 2009-01-11 21:44:33Z tim $
25 */
26
27/************************************************************
28 * Most of this information was obtained from
29 * http://www.wednesday.demon.co.uk/dosreg.html
30 * Thanks Nigel!
31 ***********************************************************/
32
33#ifndef _REGFI_H
34#define _REGFI_H
35
36#include <stdlib.h>
37#include <stdio.h>
38#include <stdbool.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "winsec.h"
50#include "void_stack.h"
51#include "range_list.h"
52#include "lru_cache.h"
53
54/******************************************************************************/
55/* Macros */
56 
57/* Registry data types */
58#define REG_NONE                       0
59#define REG_SZ                         1
60#define REG_EXPAND_SZ                  2
61#define REG_BINARY                     3
62#define REG_DWORD                      4
63#define REG_DWORD_LE                   4  /* DWORD, little endian */
64#define REG_DWORD_BE                   5  /* DWORD, big endian */
65#define REG_LINK                       6
66#define REG_MULTI_SZ                   7
67#define REG_RESOURCE_LIST              8
68#define REG_FULL_RESOURCE_DESCRIPTOR   9
69#define REG_RESOURCE_REQUIREMENTS_LIST 10
70#define REG_QWORD                      11 /* 64-bit little endian */
71/* XXX: Has MS defined a REG_QWORD_BE? */
72/* Not a real type in the registry */
73#define REG_KEY                        0x7FFFFFFF
74
75#define REGF_BLOCKSIZE             0x1000
76#define REGF_ALLOC_BLOCK           0x1000 /* Minimum allocation unit for HBINs */
77#define REGF_MAX_DEPTH             512
78
79/* header sizes for various records */
80#define REGF_MAGIC_SIZE            4
81#define HBIN_MAGIC_SIZE            4
82#define HBIN_HEADER_REC_SIZE       0x20
83#define REC_HDR_SIZE               2
84
85#define REGF_OFFSET_NONE           0xffffffff
86#define REGFI_NK_MIN_LENGTH        0x4C
87#define REGFI_VK_MIN_LENGTH        0x14
88#define REGFI_SK_MIN_LENGTH        0x14
89#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
90
91/* Constants used for validation */
92/* XXX: Can we add clock resolution validation as well as range?  It has
93 *      been reported that Windows timestamps are never more than a
94 *      certain granularity (250ms?), which could be used to help
95 *      eliminate false positives.  Would need to validate this and
96 *      perhaps conservatively implement a check.
97 */
98 /* Minimum time is Jan 1, 1990 00:00:00 */
99#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
100#define REGFI_MTIME_MIN_LOW        0x26F98000
101 /* Maximum time is Jan 1, 2290 00:00:00
102  * (We hope no one is using Windows by then...)
103  */
104#define REGFI_MTIME_MAX_HIGH       0x03047543
105#define REGFI_MTIME_MAX_LOW        0xC80A4000
106
107
108/* Flags for the vk records */
109#define VK_FLAG_NAME_PRESENT       0x0001
110#define VK_DATA_IN_OFFSET          0x80000000
111#define VK_MAX_DATA_LENGTH         1024*1024
112
113/* NK record types */
114#define NK_TYPE_LINKKEY            0x0010
115#define NK_TYPE_NORMALKEY          0x0020
116#define NK_TYPE_ROOTKEY1           0x002c
117#define NK_TYPE_ROOTKEY2           0x00ac
118 /* XXX: Unknown type that shows up in Vista registries */
119#define NK_TYPE_UNKNOWN1           0x1020
120
121
122/* HBIN block */
123typedef struct regf_hbin
124{
125  uint32 file_off;       /* my offset in the registry file */
126  uint32 ref_count;      /* how many active records are pointing to this
127                          * block (not used currently)
128                          */
129 
130  uint32 first_hbin_off; /* offset from first hbin block */
131  uint32 block_size;     /* block size of this block
132                          * Should be a multiple of 4096 (0x1000)
133                          */
134  uint32 next_block;     /* relative offset to next block. 
135                          * NOTE: This value may be unreliable!
136                          */
137
138  uint8 magic[HBIN_MAGIC_SIZE]; /* "hbin" */
139} REGF_HBIN;
140
141
142/* Subkey List -- list of key offsets and hashed names for consistency */
143typedef struct 
144{
145  uint32 nk_off;
146  uint32 hash;
147} REGF_SUBKEY_LIST_ELEM;
148
149
150typedef struct 
151{
152  uint32 offset;        /* Real offset of this record's cell in the file */
153  uint32 cell_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
154  uint32 num_keys;
155  REGF_SUBKEY_LIST_ELEM* elements;
156 
157  uint8 magic[REC_HDR_SIZE];
158} REGF_SUBKEY_LIST;
159
160
161/* Key Value */
162typedef struct 
163{
164  uint32 offset;        /* Real offset of this record's cell in the file */
165  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
166
167  REGF_HBIN* hbin;      /* pointer to HBIN record (in memory) containing
168                         * this nk record
169                         */
170  uint8* data;
171  uint16 name_length;
172  char*  valuename;
173  uint32 hbin_off;      /* offset from beginning of this hbin block */
174 
175  uint32 data_size;
176  uint32 data_off;      /* offset of data cell (virtual) */
177  uint32 type;
178  uint8  magic[REC_HDR_SIZE];
179  uint16 flag;
180  uint16 unknown1;
181  bool data_in_offset;
182} REGF_VK_REC;
183
184
185/* Key Security */
186struct _regf_sk_rec;
187
188typedef struct _regf_sk_rec
189{
190  uint32 offset;        /* Real file offset of this record */
191  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
192
193  SEC_DESC* sec_desc;
194  uint32 hbin_off;      /* offset from beginning of this hbin block */
195 
196  uint32 sk_off;        /* offset parsed from NK record used as a key
197                         * to lookup reference to this SK record
198                         */
199 
200  uint32 prev_sk_off;
201  uint32 next_sk_off;
202  uint32 ref_count;
203  uint32 desc_size;     /* size of security descriptor */
204  uint16 unknown_tag;
205  uint8  magic[REC_HDR_SIZE];
206} REGF_SK_REC;
207
208
209/* Key Name */
210typedef struct
211{
212  uint32 offset;        /* Real offset of this record's cell in the file */
213  uint32 cell_size;     /* Actual or estimated length of the cell. 
214                         * Always in multiples of 8.
215                         */
216
217  /* link in the other records here */
218  REGF_VK_REC** values;
219  REGF_SUBKEY_LIST* subkeys;
220 
221  /* header information */
222  uint16 key_type;
223  uint8  magic[REC_HDR_SIZE];
224  NTTIME mtime;
225  uint16 name_length;
226  uint16 classname_length;
227  char* classname;
228  char* keyname;
229  uint32 parent_off;                /* pointer to parent key */
230  uint32 classname_off;
231 
232  /* max lengths */
233  uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
234  uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
235  uint32 max_bytes_valuename;       /* max valuename * 2 */
236  uint32 max_bytes_value;           /* max value data size */
237 
238  /* unknowns */
239  uint32 unknown1;
240  uint32 unknown2;
241  uint32 unknown3;
242  uint32 unk_index;                 /* nigel says run time index ? */
243 
244  /* children */
245  uint32 num_subkeys;
246  uint32 subkeys_off;   /* offset of subkey list that points to NK records */
247  uint32 num_values;
248  uint32 values_off;    /* value lists which point to VK records */
249  uint32 sk_off;        /* offset to SK record */
250} REGF_NK_REC;
251
252
253
254/* REGF block */
255typedef struct 
256{
257  /* run time information */
258  int fd;         /* file descriptor */
259  /* For sanity checking (not part of the registry header) */
260  uint32 file_length;
261  void* mem_ctx;  /* memory context for run-time file access information */
262
263  /* Experimental hbin lists */
264  range_list* hbins;
265
266  /* file format information */ 
267  uint8  magic[REGF_MAGIC_SIZE];/* "regf" */
268  NTTIME mtime;
269  uint32 data_offset;           /* offset to record in the first (or any?)
270                                 * hbin block
271                                 */
272  uint32 last_block;            /* offset to last hbin block in file */
273
274  uint32 checksum;              /* Stored checksum. */
275  uint32 computed_checksum;     /* Our own calculation of the checksum.
276                                 * (XOR of bytes 0x0000 - 0x01FB)
277                                 */
278 
279  /* unknown data structure values */
280  uint32 unknown1;
281  uint32 unknown2;
282  uint32 unknown3;
283  uint32 unknown4;
284  uint32 unknown5;
285  uint32 unknown6;
286  uint32 unknown7;
287} REGF_FILE;
288
289
290
291typedef struct 
292{
293  REGF_FILE* f;
294  void_stack* key_positions;
295  lru_cache* sk_recs;
296  REGF_NK_REC* cur_key;
297  uint32 cur_subkey;
298  uint32 cur_value;
299} REGFI_ITERATOR;
300
301
302typedef struct 
303{
304  REGF_NK_REC* nk;
305  uint32 cur_subkey;
306  /* We could store a cur_value here as well, but didn't see
307   * the use in it right now.
308   */
309} REGFI_ITER_POSITION;
310
311
312/******************************************************************************/
313/* Function Declarations */
314/*  Main API */
315const char*           regfi_type_val2str(unsigned int val);
316int                   regfi_type_str2val(const char* str);
317
318char*                 regfi_get_sacl(SEC_DESC* sec_desc);
319char*                 regfi_get_dacl(SEC_DESC* sec_desc);
320char*                 regfi_get_owner(SEC_DESC* sec_desc);
321char*                 regfi_get_group(SEC_DESC* sec_desc);
322
323REGF_FILE*            regfi_open(const char* filename);
324int                   regfi_close(REGF_FILE* r);
325
326REGFI_ITERATOR*       regfi_iterator_new(REGF_FILE* fh);
327void                  regfi_iterator_free(REGFI_ITERATOR* i);
328bool                  regfi_iterator_down(REGFI_ITERATOR* i);
329bool                  regfi_iterator_up(REGFI_ITERATOR* i);
330bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
331
332bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
333                                                 const char* subkey_name);
334bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i, 
335                                               const char** path);
336const REGF_NK_REC*    regfi_iterator_cur_key(REGFI_ITERATOR* i);
337const REGF_SK_REC*    regfi_iterator_cur_sk(REGFI_ITERATOR* i);
338const REGF_NK_REC*    regfi_iterator_first_subkey(REGFI_ITERATOR* i);
339const REGF_NK_REC*    regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
340const REGF_NK_REC*    regfi_iterator_next_subkey(REGFI_ITERATOR* i);
341
342bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
343                                                const char* value_name);
344const REGF_VK_REC*    regfi_iterator_first_value(REGFI_ITERATOR* i);
345const REGF_VK_REC*    regfi_iterator_cur_value(REGFI_ITERATOR* i);
346const REGF_VK_REC*    regfi_iterator_next_value(REGFI_ITERATOR* i);
347
348
349/********************************************************/
350/* Middle-layer structure caching, loading, and linking */
351/********************************************************/
352REGF_HBIN* regfi_lookup_hbin(REGF_FILE* file, uint32 offset);
353
354REGF_NK_REC* regfi_load_key(REGF_FILE* file, uint32 offset, bool strict);
355
356REGF_SUBKEY_LIST* regfi_load_subkeylist(REGF_FILE* file, uint32 offset, 
357                                        uint32 num_keys, uint32 max_size, 
358                                        bool strict);
359
360REGF_VK_REC** regfi_load_valuelist(REGF_FILE* file, uint32 offset, 
361                                   uint32 num_values, uint32 max_size, 
362                                   bool strict);
363
364REGF_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists, 
365                                          REGF_SUBKEY_LIST** lists,
366                                          bool strict);
367
368/************************************/
369/*  Low-layer data structure access */
370/************************************/
371REGF_FILE*            regfi_parse_regf(int fd, bool strict);
372REGF_HBIN*            regfi_parse_hbin(REGF_FILE* file, uint32 offset, 
373                                       bool strict);
374
375
376/* regfi_parse_nk: Parses an NK record.
377 *
378 * Arguments:
379 *   f        -- the registry file structure
380 *   offset   -- the offset of the cell (not the record) to be parsed.
381 *   max_size -- the maximum size the NK cell could be. (for validation)
382 *   strict   -- if true, rejects any malformed records.  Otherwise,
383 *               tries to minimally validate integrity.
384 * Returns:
385 *   A newly allocated NK record structure, or NULL on failure.
386 */
387REGF_NK_REC*          regfi_parse_nk(REGF_FILE* file, uint32 offset, 
388                                     uint32 max_size, bool strict);
389
390REGF_VK_REC* regfi_parse_vk(REGF_FILE* file, uint32 offset, 
391                            uint32 max_size, bool strict);
392
393uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, 
394                        uint32 length, uint32 max_size, bool strict);
395
396REGF_SK_REC* regfi_parse_sk(REGF_FILE* file, uint32 offset, uint32 max_size, bool strict);
397
398range_list* regfi_parse_unalloc_cells(REGF_FILE* file);
399
400bool regfi_parse_cell(int fd, uint32 offset, uint8* hdr, uint32 hdr_len,
401                      uint32* cell_length, bool* unalloc);
402
403char* regfi_parse_classname(REGF_FILE* file, uint32 offset,
404                            uint16* name_length, uint32 max_size, bool strict);
405
406
407/* Private Functions */
408REGF_NK_REC*          regfi_rootkey(REGF_FILE* file);
409void                  regfi_key_free(REGF_NK_REC* nk);
410void                  regfi_subkeylist_free(REGF_SUBKEY_LIST* list);
411uint32                regfi_read(int fd, uint8* buf, uint32* length);
412
413
414#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.