source: trunk/include/regfi.h @ 143

Last change on this file since 143 was 143, checked in by tim, 15 years ago

fixed a null pointer exception

removed some dependencies on less portable items

altered Makefiles to allow for MinGW cross compiling
  • Property svn:keywords set to Id
File size: 16.4 KB
Line 
1/*
2 * Branched from Samba project Subversion repository, version #6903:
3 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Windows NT (and later) registry parsing library
6 *
7 * Copyright (C) 2005-2009 Timothy D. Morgan
8 * Copyright (C) 2005 Gerald (Jerry) Carter
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; version 3 of the License.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 *
23 * $Id: regfi.h 143 2009-02-13 03:24:27Z tim $
24 */
25
26/************************************************************
27 * Most of this information was obtained from
28 * http://www.wednesday.demon.co.uk/dosreg.html
29 * Thanks Nigel!
30 ***********************************************************/
31
32#ifndef _REGFI_H
33#define _REGFI_H
34
35#include <stdlib.h>
36#include <stdio.h>
37#include <stdbool.h>
38#include <stdarg.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "smb_deps.h"
49#include "winsec.h"
50#include "void_stack.h"
51#include "range_list.h"
52#include "lru_cache.h"
53
54/******************************************************************************/
55
56/* regfi library error message types */
57#define REGFI_MSG_INFO  0x0001
58#define REGFI_MSG_WARN  0x0004
59#define REGFI_MSG_ERROR 0x0010
60
61/* Windows is lame */
62#ifdef O_BINARY
63#define REGFI_OPEN_FLAGS O_RDONLY|O_BINARY
64#else
65#define REGFI_OPEN_FLAGS O_RDONLY
66#endif
67
68/* Registry data types */
69#define REG_NONE                       0
70#define REG_SZ                         1
71#define REG_EXPAND_SZ                  2
72#define REG_BINARY                     3
73#define REG_DWORD                      4
74#define REG_DWORD_LE                   4  /* DWORD, little endian */
75#define REG_DWORD_BE                   5  /* DWORD, big endian */
76#define REG_LINK                       6
77#define REG_MULTI_SZ                   7
78#define REG_RESOURCE_LIST              8
79#define REG_FULL_RESOURCE_DESCRIPTOR   9
80#define REG_RESOURCE_REQUIREMENTS_LIST 10
81#define REG_QWORD                      11 /* 64-bit little endian */
82/* XXX: Has MS defined a REG_QWORD_BE? */
83/* Not a real type in the registry */
84#define REG_KEY                    0x7FFFFFFF
85
86#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
87#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
88#define REGFI_MAX_DEPTH            512
89#define REGFI_OFFSET_NONE          0xffffffff
90
91/* XXX: This is totally arbitrary right now. */
92#define REGFI_MAX_SUBKEY_DEPTH     255   
93
94/* Header sizes and magic number lengths for various records */
95#define REGFI_REGF_MAGIC_SIZE      4
96#define REGFI_HBIN_MAGIC_SIZE      4
97#define REGFI_CELL_MAGIC_SIZE      2
98#define REGFI_HBIN_HEADER_SIZE     0x20
99#define REGFI_NK_MIN_LENGTH        0x4C
100#define REGFI_VK_MIN_LENGTH        0x14
101#define REGFI_SK_MIN_LENGTH        0x14
102#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
103
104
105/* Constants used for validation */
106/* XXX: Can we add clock resolution validation as well as range?  It has
107 *      been reported that Windows timestamps are never more than a
108 *      certain granularity (250ms?), which could be used to help
109 *      eliminate false positives.  Would need to validate this and
110 *      perhaps conservatively implement a check.
111 */
112 /* Minimum time is Jan 1, 1990 00:00:00 */
113#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
114#define REGFI_MTIME_MIN_LOW        0x26F98000
115 /* Maximum time is Jan 1, 2290 00:00:00
116  * (We hope no one is using Windows by then...)
117  */
118#define REGFI_MTIME_MAX_HIGH       0x03047543
119#define REGFI_MTIME_MAX_LOW        0xC80A4000
120
121
122/* Flags for the vk records */
123#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
124#define REGFI_VK_DATA_IN_OFFSET    0x80000000
125#define REGFI_VK_MAX_DATA_LENGTH   1024*1024
126
127
128/* NK record types */
129/* XXX: This is starting to look like this is a flags field. 
130 *      Need to decipher the meaning of each flag.
131 */
132#define REGFI_NK_TYPE_LINKKEY      0x0010
133#define REGFI_NK_TYPE_NORMALKEY    0x0020
134 /* XXX: Unknown key type that shows up in Vista registries */
135#define REGFI_NK_TYPE_UNKNOWN1     0x1020
136 /* XXX: Unknown key types that shows up in W2K3 registries */
137#define REGFI_NK_TYPE_UNKNOWN2     0x4020
138#define REGFI_NK_TYPE_UNKNOWN3     0x0000  /* XXX: This type seems to have UTF-16 names!!! */
139#define REGFI_NK_TYPE_ROOTKEY1     0x002c
140 /* XXX: Unknown root key type that shows up in Vista registries */
141#define REGFI_NK_TYPE_ROOTKEY2     0x00ac
142
143#if 0
144/* Initial hypothesis of NK flags: */
145/***********************************/
146#define REGFI_NK_FLAG_LINK         0x0010
147/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
148#define REGFI_NK_FLAG_ASCIINAME    0x0020
149/* These next two combine to form the "c" on both known root key types */
150#define REGFI_NK_FLAG_ROOT1        0x0008
151#define REGFI_NK_FLAG_ROOT2        0x0004
152/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
153#define REGFI_NK_FLAG_UNKNOWN1     0x4000
154#define REGFI_NK_FLAG_UNKNOWN2     0x1000
155/* This next one shows up on root keys in some Vista "software" registries */
156#define REGFI_NK_FLAG_UNKNOWN3     0x0080
157#endif
158
159
160
161/* HBIN block */
162typedef struct _regfi_hbin
163{
164  uint32 file_off;       /* my offset in the registry file */
165  uint32 ref_count;      /* how many active records are pointing to this
166                          * block (not used currently)
167                          */
168 
169  uint32 first_hbin_off; /* offset from first hbin block */
170  uint32 block_size;     /* block size of this block
171                          * Should be a multiple of 4096 (0x1000)
172                          */
173  uint32 next_block;     /* relative offset to next block. 
174                          * NOTE: This value may be unreliable!
175                          */
176
177  uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
178} REGFI_HBIN;
179
180
181/* Subkey List -- list of key offsets and hashed names for consistency */
182typedef struct 
183{
184  /* Virtual offset of NK record or additional subkey list,
185   * depending on this list's type.
186   */
187  uint32 offset;
188
189  uint32 hash;
190} REGFI_SUBKEY_LIST_ELEM;
191
192
193typedef struct 
194{
195  /* Real offset of this record's cell in the file */
196  uint32 offset;
197
198  uint32 cell_size;
199 
200  /* Number of immediate children */
201  uint32 num_children; 
202
203  /* Total number of keys referenced by this list and it's children */
204  uint32 num_keys;     
205
206  REGFI_SUBKEY_LIST_ELEM* elements;
207  uint8 magic[REGFI_CELL_MAGIC_SIZE];
208
209  /* Set if the magic indicates this subkey list points to child subkey lists */
210  bool recursive_type; 
211} REGFI_SUBKEY_LIST;
212
213
214/* Key Value */
215typedef struct 
216{
217  uint32 offset;        /* Real offset of this record's cell in the file */
218  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
219
220  REGFI_HBIN* hbin;     /* pointer to HBIN record (in memory) containing
221                         * this nk record
222                         */
223  uint8* data;
224  uint16 name_length;
225  char*  valuename;
226  uint32 hbin_off;      /* offset from beginning of this hbin block */
227 
228  uint32 data_size;
229  uint32 data_off;      /* offset of data cell (virtual) */
230  uint32 type;
231  uint8  magic[REGFI_CELL_MAGIC_SIZE];
232  uint16 flag;
233  uint16 unknown1;
234  bool data_in_offset;
235} REGFI_VK_REC;
236
237
238/* Key Security */
239struct _regfi_sk_rec;
240
241typedef struct _regfi_sk_rec
242{
243  uint32 offset;        /* Real file offset of this record */
244  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
245
246  WINSEC_DESC* sec_desc;
247  uint32 hbin_off;      /* offset from beginning of this hbin block */
248 
249  uint32 sk_off;        /* offset parsed from NK record used as a key
250                         * to lookup reference to this SK record
251                         */
252 
253  uint32 prev_sk_off;
254  uint32 next_sk_off;
255  uint32 ref_count;
256  uint32 desc_size;     /* size of security descriptor */
257  uint16 unknown_tag;
258  uint8  magic[REGFI_CELL_MAGIC_SIZE];
259} REGFI_SK_REC;
260
261
262/* Key Name */
263typedef struct
264{
265  uint32 offset;        /* Real offset of this record's cell in the file */
266  uint32 cell_size;     /* Actual or estimated length of the cell. 
267                         * Always in multiples of 8.
268                         */
269
270  /* link in the other records here */
271  REGFI_VK_REC** values;
272  REGFI_SUBKEY_LIST* subkeys;
273 
274  /* header information */
275  uint16 key_type;
276  uint8  magic[REGFI_CELL_MAGIC_SIZE];
277  NTTIME mtime;
278  uint16 name_length;
279  uint16 classname_length;
280  char* classname;
281  char* keyname;
282  uint32 parent_off;                /* pointer to parent key */
283  uint32 classname_off;
284 
285  /* max lengths */
286  uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
287  uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
288  uint32 max_bytes_valuename;       /* max valuename * 2 */
289  uint32 max_bytes_value;           /* max value data size */
290 
291  /* unknowns */
292  uint32 unknown1;
293  uint32 unknown2;
294  uint32 unknown3;
295  uint32 unk_index;                 /* nigel says run time index ? */
296 
297  /* children */
298  uint32 num_subkeys;
299  uint32 subkeys_off;   /* offset of subkey list that points to NK records */
300  uint32 num_values;
301  uint32 values_off;    /* value lists which point to VK records */
302  uint32 sk_off;        /* offset to SK record */
303} REGFI_NK_REC;
304
305
306
307/* REGF block */
308typedef struct 
309{
310  /* Run-time information */
311  /************************/
312  /* file descriptor */
313  int fd;
314
315  /* For sanity checking (not part of the registry header) */
316  uint32 file_length;
317
318  /* Metadata about hbins */
319  range_list* hbins;
320
321  /* Error/warning/info messages returned by lower layer functions */
322  char* last_message;
323
324  /* Mask for error message types that will be stored. */
325  uint16 msg_mask;
326
327
328  /* Data parsed from file header */
329  /********************************/
330  uint8  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
331  NTTIME mtime;
332  uint32 data_offset;           /* offset to record in the first (or any?)
333                                 * hbin block
334                                 */
335  uint32 last_block;            /* offset to last hbin block in file */
336
337  uint32 checksum;              /* Stored checksum. */
338  uint32 computed_checksum;     /* Our own calculation of the checksum.
339                                 * (XOR of bytes 0x0000 - 0x01FB)
340                                 */
341 
342  /* XXX: Some of these we have some clues about (major/minor version, etc).
343   *      Should verify and update names accordingly.
344   */
345  /* unknown data structure values */
346  uint32 unknown1;
347  uint32 unknown2;
348  uint32 unknown3;
349  uint32 unknown4;
350  uint32 unknown5;
351  uint32 unknown6;
352  uint32 unknown7;
353} REGFI_FILE;
354
355
356/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
357 *      structure, probably REGFI_FILE.  Once key caching is in place,
358 *      convert key_positions stack to store just key offsets rather than
359 *      whole keys.
360 */
361typedef struct 
362{
363  REGFI_FILE* f;
364  void_stack* key_positions;
365  lru_cache* sk_recs;
366  REGFI_NK_REC* cur_key;
367  uint32 cur_subkey;
368  uint32 cur_value;
369} REGFI_ITERATOR;
370
371
372typedef struct 
373{
374  /* XXX: Should probably eliminate the storage of keys here
375   *      once key caching is implemented.
376   */
377  REGFI_NK_REC* nk;
378  uint32 cur_subkey;
379  /* We could store a cur_value here as well, but didn't see
380   * the use in it right now.
381   */
382} REGFI_ITER_POSITION;
383
384
385/******************************************************************************/
386/*                         Main iterator API                                  */
387/******************************************************************************/
388REGFI_FILE*           regfi_open(const char* filename);
389int                   regfi_close(REGFI_FILE* r);
390
391/* regfi_get_messages: Get errors, warnings, and/or verbose information
392 *                     relating to processing of the given registry file.
393 *
394 * Arguments:
395 *   file     -- the structure for the registry file
396 *
397 * Returns:
398 *   A newly allocated char* which must be free()d by the caller.
399 */
400char*                 regfi_get_messages(REGFI_FILE* file);
401void                  regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
402
403REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* fh);
404void                  regfi_iterator_free(REGFI_ITERATOR* i);
405bool                  regfi_iterator_down(REGFI_ITERATOR* i);
406bool                  regfi_iterator_up(REGFI_ITERATOR* i);
407bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
408
409bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
410                                                 const char* subkey_name);
411bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i, 
412                                               const char** path);
413const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
414const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
415const REGFI_NK_REC*   regfi_iterator_first_subkey(REGFI_ITERATOR* i);
416const REGFI_NK_REC*   regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
417const REGFI_NK_REC*   regfi_iterator_next_subkey(REGFI_ITERATOR* i);
418
419bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
420                                                const char* value_name);
421const REGFI_VK_REC*   regfi_iterator_first_value(REGFI_ITERATOR* i);
422const REGFI_VK_REC*   regfi_iterator_cur_value(REGFI_ITERATOR* i);
423const REGFI_VK_REC*   regfi_iterator_next_value(REGFI_ITERATOR* i);
424
425
426/********************************************************/
427/* Middle-layer structure caching, loading, and linking */
428/********************************************************/
429REGFI_HBIN*           regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
430REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32 offset, 
431                                     bool strict);
432REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32 offset, 
433                                            uint32 num_keys, uint32 max_size, 
434                                            bool strict);
435REGFI_VK_REC**        regfi_load_valuelist(REGFI_FILE* file, uint32 offset, 
436                                           uint32 num_values, uint32 max_size, 
437                                           bool strict);
438
439/************************************/
440/*  Low-layer data structure access */
441/************************************/
442REGFI_FILE*           regfi_parse_regf(int fd, bool strict);
443REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32 offset, 
444                                       bool strict);
445
446
447/* regfi_parse_nk: Parses an NK record.
448 *
449 * Arguments:
450 *   f        -- the registry file structure
451 *   offset   -- the offset of the cell (not the record) to be parsed.
452 *   max_size -- the maximum size the NK cell could be. (for validation)
453 *   strict   -- if true, rejects any malformed records.  Otherwise,
454 *               tries to minimally validate integrity.
455 * Returns:
456 *   A newly allocated NK record structure, or NULL on failure.
457 */
458REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32 offset, 
459                                     uint32 max_size, bool strict);
460
461REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
462                                             uint32 max_size, bool strict);
463
464REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32 offset, 
465                                     uint32 max_size, bool strict);
466
467uint8*                regfi_parse_data(REGFI_FILE* file, uint32 offset, 
468                                       uint32 length, uint32 max_size, 
469                                       bool strict);
470
471REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32 offset, 
472                                     uint32 max_size, bool strict);
473
474range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
475
476bool                  regfi_parse_cell(int fd, uint32 offset, 
477                                       uint8* hdr, uint32 hdr_len,
478                                       uint32* cell_length, bool* unalloc);
479
480char*                 regfi_parse_classname(REGFI_FILE* file, uint32 offset,
481                                            uint16* name_length, 
482                                            uint32 max_size, bool strict);
483
484
485/************************************/
486/*    Private Functions             */
487/************************************/
488REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file);
489void                  regfi_key_free(REGFI_NK_REC* nk);
490void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
491uint32                regfi_read(int fd, uint8* buf, uint32* length);
492
493const char*           regfi_type_val2str(unsigned int val);
494int                   regfi_type_str2val(const char* str);
495
496char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
497char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
498char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
499char*                 regfi_get_group(WINSEC_DESC* sec_desc);
500
501REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16 num_lists, 
502                                              REGFI_SUBKEY_LIST** lists,
503                                              bool strict);
504REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
505                                                uint32 max_size, bool strict,
506                                                uint8 depth_left);
507void                  regfi_add_message(REGFI_FILE* file, uint16 msg_type, 
508                                        const char* fmt, ...);
509#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.