source: trunk/include/regfi.h @ 151

Last change on this file since 151 was 151, checked in by tim, 16 years ago

parsed more items from regf header structure

improved feedback from regfi_parse_data

  • Property svn:keywords set to Id
File size: 18.5 KB
Line 
1/*
2 * Branched from Samba project Subversion repository, version #6903:
3 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4 *
5 * Windows NT (and later) registry parsing library
6 *
7 * Copyright (C) 2005-2009 Timothy D. Morgan
8 * Copyright (C) 2005 Gerald (Jerry) Carter
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; version 3 of the License.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 *
23 * $Id: regfi.h 151 2009-03-04 21:14:09Z tim $
24 */
25
26/************************************************************
27 * Most of this information was obtained from
28 * http://www.wednesday.demon.co.uk/dosreg.html
29 * Thanks Nigel!
30 ***********************************************************/
31
32#ifndef _REGFI_H
33#define _REGFI_H
34
35#include <stdlib.h>
36#include <stdio.h>
37#include <stdbool.h>
38#include <stdarg.h>
39#include <string.h>
40#include <errno.h>
41#include <time.h>
42#include <fcntl.h>
43#include <sys/stat.h>
44#include <sys/types.h>
45#include <unistd.h>
46#include <assert.h>
47
48#include "talloc.h"
49#include "smb_deps.h"
50#include "winsec.h"
51#include "void_stack.h"
52#include "range_list.h"
53#include "lru_cache.h"
54
55/******************************************************************************/
56
57/* regfi library error message types */
58#define REGFI_MSG_INFO  0x0001
59#define REGFI_MSG_WARN  0x0004
60#define REGFI_MSG_ERROR 0x0010
61
62/* Windows is lame */
63#ifdef O_BINARY
64#define REGFI_OPEN_FLAGS O_RDONLY|O_BINARY
65#else
66#define REGFI_OPEN_FLAGS O_RDONLY
67#endif
68
69/* Registry data types */
70#define REG_NONE                       0
71#define REG_SZ                         1
72#define REG_EXPAND_SZ                  2
73#define REG_BINARY                     3
74#define REG_DWORD                      4
75#define REG_DWORD_LE                   4  /* DWORD, little endian */
76#define REG_DWORD_BE                   5  /* DWORD, big endian */
77#define REG_LINK                       6
78#define REG_MULTI_SZ                   7
79#define REG_RESOURCE_LIST              8
80#define REG_FULL_RESOURCE_DESCRIPTOR   9
81#define REG_RESOURCE_REQUIREMENTS_LIST 10
82#define REG_QWORD                      11 /* 64-bit little endian */
83/* XXX: Has MS defined a REG_QWORD_BE? */
84/* Not a real type in the registry */
85#define REG_KEY                    0x7FFFFFFF
86
87#define REGFI_MAX_DEPTH            512
88#define REGFI_OFFSET_NONE          0xffffffff
89
90/* XXX: This is totally arbitrary right now. */
91#define REGFI_MAX_SUBKEY_DEPTH     255
92
93/* Header sizes and magic number lengths for various records */
94#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
95#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
96#define REGFI_REGF_MAGIC_SIZE      4
97#define REGFI_REGF_NAME_SIZE       64
98
99#define REGFI_REGF_RESERVED1_SIZE  340
100#define REGFI_REGF_RESERVED2_SIZE  3528
101
102#define REGFI_HBIN_MAGIC_SIZE      4
103#define REGFI_CELL_MAGIC_SIZE      2
104#define REGFI_HBIN_HEADER_SIZE     0x20
105#define REGFI_NK_MIN_LENGTH        0x4C
106#define REGFI_VK_MIN_LENGTH        0x14
107#define REGFI_SK_MIN_LENGTH        0x14
108#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
109
110
111/* Constants used for validation */
112/* XXX: Can we add clock resolution validation as well as range?  It has
113 *      been reported that Windows timestamps are never more than a
114 *      certain granularity (250ms?), which could be used to help
115 *      eliminate false positives.  Would need to verify this and
116 *      perhaps conservatively implement a check.
117 */
118 /* Minimum time is Jan 1, 1990 00:00:00 */
119#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
120#define REGFI_MTIME_MIN_LOW        0x26F98000
121 /* Maximum time is Jan 1, 2290 00:00:00
122  * (We hope no one is using Windows by then...)
123  */
124#define REGFI_MTIME_MAX_HIGH       0x03047543
125#define REGFI_MTIME_MAX_LOW        0xC80A4000
126
127
128/* Flags for the vk records */
129#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
130#define REGFI_VK_DATA_IN_OFFSET    0x80000000
131#define REGFI_VK_MAX_DATA_LENGTH   1024*1024
132
133
134/* NK record types */
135/* XXX: This is starting to look like this is a flags field. 
136 *      Need to decipher the meaning of each flag.
137 */
138#define REGFI_NK_TYPE_LINKKEY      0x0010
139#define REGFI_NK_TYPE_NORMALKEY    0x0020
140 /* XXX: Unknown key type that shows up in Vista registries */
141#define REGFI_NK_TYPE_UNKNOWN1     0x1020
142 /* XXX: Unknown key types that shows up in W2K3 registries */
143#define REGFI_NK_TYPE_UNKNOWN2     0x4020
144#define REGFI_NK_TYPE_UNKNOWN3     0x0000  /* XXX: This type seems to have UTF-16 names!!! */
145#define REGFI_NK_TYPE_ROOTKEY1     0x002c
146 /* XXX: Unknown root key type that shows up in Vista registries */
147#define REGFI_NK_TYPE_ROOTKEY2     0x00ac
148
149#if 0
150/* Initial hypothesis of NK flags: */
151/***********************************/
152#define REGFI_NK_FLAG_LINK         0x0010
153/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
154#define REGFI_NK_FLAG_ASCIINAME    0x0020
155/* These next two combine to form the "c" on both known root key types */
156#define REGFI_NK_FLAG_ROOT1        0x0008
157#define REGFI_NK_FLAG_ROOT2        0x0004
158/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
159#define REGFI_NK_FLAG_UNKNOWN1     0x4000
160#define REGFI_NK_FLAG_UNKNOWN2     0x1000
161/* This next one shows up on root keys in some Vista "software" registries */
162#define REGFI_NK_FLAG_UNKNOWN3     0x0080
163#endif
164
165
166/* HBIN block */
167typedef struct _regfi_hbin
168{
169  uint32 file_off;       /* my offset in the registry file */
170  uint32 ref_count;      /* how many active records are pointing to this
171                          * block (not used currently)
172                          */
173 
174  uint32 first_hbin_off; /* offset from first hbin block */
175  uint32 block_size;     /* block size of this block
176                          * Should be a multiple of 4096 (0x1000)
177                          */
178  uint32 next_block;     /* relative offset to next block. 
179                          * NOTE: This value may be unreliable!
180                          */
181
182  uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
183} REGFI_HBIN;
184
185
186/* Subkey List -- list of key offsets and hashed names for consistency */
187typedef struct 
188{
189  /* Virtual offset of NK record or additional subkey list,
190   * depending on this list's type.
191   */
192  uint32 offset;
193
194  uint32 hash;
195} REGFI_SUBKEY_LIST_ELEM;
196
197
198typedef struct _regfi_subkey_list
199{
200  /* Real offset of this record's cell in the file */
201  uint32 offset;
202
203  uint32 cell_size;
204 
205  /* Number of immediate children */
206  uint32 num_children; 
207
208  /* Total number of keys referenced by this list and it's children */
209  uint32 num_keys;     
210
211  REGFI_SUBKEY_LIST_ELEM* elements;
212  uint8 magic[REGFI_CELL_MAGIC_SIZE];
213
214  /* Set if the magic indicates this subkey list points to child subkey lists */
215  bool recursive_type; 
216} REGFI_SUBKEY_LIST;
217
218
219typedef uint32 REGFI_VALUE_LIST_ELEM;
220typedef struct _regfi_value_list
221{
222  /* Actual number of values referenced by this list. 
223   * May differ from parent key's num_values if there were parsing errors.
224   */
225  uint32 num_values;
226
227  REGFI_VALUE_LIST_ELEM* elements;
228} REGFI_VALUE_LIST;
229
230
231/* Value record */
232typedef struct 
233{
234  uint32 offset;        /* Real offset of this record's cell in the file */
235  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
236
237  uint8* data;
238  char*  valuename;
239  uint16 name_length;
240  uint32 hbin_off;      /* offset from beginning of this hbin block */
241 
242  uint32 data_size;
243  uint32 data_off;      /* offset of data cell (virtual) */
244  uint32 type;
245  uint8  magic[REGFI_CELL_MAGIC_SIZE];
246  uint16 flag;
247  uint16 unknown1;
248  bool data_in_offset;
249} REGFI_VK_REC;
250
251
252/* Key Security */
253struct _regfi_sk_rec;
254
255typedef struct _regfi_sk_rec
256{
257  uint32 offset;        /* Real file offset of this record */
258  uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
259
260  WINSEC_DESC* sec_desc;
261  uint32 hbin_off;      /* offset from beginning of this hbin block */
262 
263  uint32 prev_sk_off;
264  uint32 next_sk_off;
265  uint32 ref_count;
266  uint32 desc_size;     /* size of security descriptor */
267  uint16 unknown_tag;
268  uint8  magic[REGFI_CELL_MAGIC_SIZE];
269} REGFI_SK_REC;
270
271
272/* Key Name */
273typedef struct
274{
275  uint32 offset;        /* Real offset of this record's cell in the file */
276  uint32 cell_size;     /* Actual or estimated length of the cell. 
277                         * Always in multiples of 8.
278                         */
279
280  /* link in the other records here */
281  REGFI_VALUE_LIST* values;
282  REGFI_SUBKEY_LIST* subkeys;
283 
284  /* header information */
285  uint16 key_type;
286  uint8  magic[REGFI_CELL_MAGIC_SIZE];
287  NTTIME mtime;
288  uint16 name_length;
289  uint16 classname_length;
290  char* classname;
291  char* keyname;
292  uint32 parent_off;                /* pointer to parent key */
293  uint32 classname_off;
294 
295  /* max lengths */
296  uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
297  uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
298  uint32 max_bytes_valuename;       /* max valuename * 2 */
299  uint32 max_bytes_value;           /* max value data size */
300 
301  /* unknowns */
302  uint32 unknown1;
303  uint32 unknown2;
304  uint32 unknown3;
305  uint32 unk_index;                 /* nigel says run time index ? */
306 
307  /* children */
308  uint32 num_subkeys;
309  uint32 subkeys_off;   /* offset of subkey list that points to NK records */
310  uint32 num_values;
311  uint32 values_off;    /* value lists which point to VK records */
312  uint32 sk_off;        /* offset to SK record */
313} REGFI_NK_REC;
314
315
316
317/* REGF block */
318typedef struct 
319{
320  /* Run-time information */
321  /************************/
322  /* file descriptor */
323  int fd;
324
325  /* For sanity checking (not part of the registry header) */
326  uint32 file_length;
327
328  /* Metadata about hbins */
329  range_list* hbins;
330
331  /* SK record cached since they're repeatedly reused */
332  lru_cache* sk_cache;
333
334  /* Error/warning/info messages returned by lower layer functions */
335  char* last_message;
336
337  /* Mask for error message types that will be stored. */
338  uint16 msg_mask;
339
340
341  /* Data parsed from file header */
342  /********************************/
343  uint8  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
344
345 /* These sequence numbers should match if
346  * the hive was properly synced to disk.
347  */
348  uint32 sequence1;           
349  uint32 sequence2;
350
351  NTTIME mtime;
352  uint32 major_version;  /* XXX: Unverified. Set to 1 in all known hives */
353  uint32 minor_version;  /* XXX: Unverified. Set to 3 or 5 in all known hives */
354  uint32 type;           /* XXX: Unverified.  Set to 0 in all known hives */
355  uint32 format;         /* XXX: Unverified.  Set to 1 in all known hives */
356
357  uint32 root_cell;  /* Offset to root cell in the first (or any?) hbin block */
358  uint32 last_block; /* Offset to last hbin block in file
359                      * (or length of file minus header?) */
360
361  uint32 cluster;    /* XXX: Unverified. Set to 1 in all known hives */
362
363  /* Matches hive's base file name. Stored in UTF-16LE */
364  uint8 file_name[REGFI_REGF_NAME_SIZE];
365
366  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
367  WINSEC_UUID* log_id;      /* XXX: Unverified. */
368  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
369  uint32 flags;             /* XXX: Unverified. */
370  uint32 guid_signature;    /* XXX: Unverified. */
371
372  uint32 checksum;          /* Stored checksum from file */
373  uint32 computed_checksum; /* Our own calculation of the checksum.
374                             * (XOR of bytes 0x0000 - 0x01FB) */
375
376  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
377  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
378  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
379  uint32 boot_type;         /* XXX: Unverified. */
380  uint32 boot_recover;      /* XXX: Unverified. */
381
382  /* This seems to include random junk.  Possibly unsanitized memory left over
383   * from when header block was written.  For instance, chunks of nk records
384   * can be found, though often it's all 0s. */
385  uint8 reserved1[REGFI_REGF_RESERVED1_SIZE];
386
387  /* This is likely reserved and unusued currently.  (Should be all 0s.)
388   * Included here for easier access in looking for hidden data
389   * or doing research. */
390  uint8 reserved2[REGFI_REGF_RESERVED2_SIZE];
391
392} REGFI_FILE;
393
394
395/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
396 *      structure, probably REGFI_FILE.  Once key caching is in place,
397 *      convert key_positions stack to store just key offsets rather than
398 *      whole keys.
399 */
400typedef struct _regfi_iterator
401{
402  REGFI_FILE* f;
403  void_stack* key_positions;
404  REGFI_NK_REC* cur_key;
405  uint32 cur_subkey;
406  uint32 cur_value;
407} REGFI_ITERATOR;
408
409
410typedef struct _regfi_iter_position
411{
412  REGFI_NK_REC* nk;
413  uint32 cur_subkey;
414  /* We could store a cur_value here as well, but didn't see
415   * the use in it right now.
416   */
417} REGFI_ITER_POSITION;
418
419
420typedef struct _regfi_buffer
421{
422  uint8* buf;
423  uint32_t len;
424} REGFI_BUFFER;
425
426
427/******************************************************************************/
428/*                         Main iterator API                                  */
429/******************************************************************************/
430REGFI_FILE*           regfi_open(const char* filename);
431int                   regfi_close(REGFI_FILE* r);
432
433/* regfi_get_messages: Get errors, warnings, and/or verbose information
434 *                     relating to processing of the given registry file.
435 *
436 * Arguments:
437 *   file     -- the structure for the registry file
438 *
439 * Returns:
440 *   A newly allocated char* which must be free()d by the caller.
441 */
442char*                 regfi_get_messages(REGFI_FILE* file);
443void                  regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
444
445REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* fh);
446void                  regfi_iterator_free(REGFI_ITERATOR* i);
447bool                  regfi_iterator_down(REGFI_ITERATOR* i);
448bool                  regfi_iterator_up(REGFI_ITERATOR* i);
449bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
450
451bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
452                                                 const char* subkey_name);
453bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i, 
454                                               const char** path);
455const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
456const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
457
458REGFI_NK_REC*         regfi_iterator_first_subkey(REGFI_ITERATOR* i);
459REGFI_NK_REC*         regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
460REGFI_NK_REC*         regfi_iterator_next_subkey(REGFI_ITERATOR* i);
461
462bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
463                                                const char* value_name);
464REGFI_VK_REC*         regfi_iterator_first_value(REGFI_ITERATOR* i);
465REGFI_VK_REC*         regfi_iterator_cur_value(REGFI_ITERATOR* i);
466REGFI_VK_REC*         regfi_iterator_next_value(REGFI_ITERATOR* i);
467
468
469/********************************************************/
470/* Middle-layer structure loading, linking, and caching */
471/********************************************************/
472REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32 offset, 
473                                     bool strict);
474REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32 offset, 
475                                       bool strict);
476REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
477                                            uint32 num_keys, uint32 max_size,
478                                            bool strict);
479REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32 offset, 
480                                           uint32 num_values, uint32 max_size,
481                                           bool strict);
482
483/* These are cached so return values don't need to be freed. */
484const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32 offset,
485                                    bool strict);
486const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32 voffset);
487
488
489
490/************************************/
491/*  Low-layer data structure access */
492/************************************/
493REGFI_FILE*           regfi_parse_regf(int fd, bool strict);
494REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32 offset, 
495                                       bool strict);
496
497
498/* regfi_parse_nk: Parses an NK record.
499 *
500 * Arguments:
501 *   f        -- the registry file structure
502 *   offset   -- the offset of the cell (not the record) to be parsed.
503 *   max_size -- the maximum size the NK cell could be. (for validation)
504 *   strict   -- if true, rejects any malformed records.  Otherwise,
505 *               tries to minimally validate integrity.
506 * Returns:
507 *   A newly allocated NK record structure, or NULL on failure.
508 */
509REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32 offset,
510                                     uint32 max_size, bool strict);
511
512REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
513                                             uint32 max_size, bool strict);
514
515REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32 offset, 
516                                     uint32 max_size, bool strict);
517
518REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, 
519                                       uint32 data_type, uint32 offset, 
520                                       uint32 length, uint32 max_size, 
521                                       bool data_in_offset, bool strict);
522
523REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32 offset, 
524                                     uint32 max_size, bool strict);
525
526range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
527
528bool                  regfi_parse_cell(int fd, uint32 offset, 
529                                       uint8* hdr, uint32 hdr_len,
530                                       uint32* cell_length, bool* unalloc);
531
532char*                 regfi_parse_classname(REGFI_FILE* file, uint32 offset,
533                                            uint16* name_length, 
534                                            uint32 max_size, bool strict);
535
536/* Dispose of previously parsed records */
537void                  regfi_free_key(REGFI_NK_REC* nk);
538void                  regfi_free_value(REGFI_VK_REC* vk);
539
540
541
542/************************************/
543/*    Private Functions             */
544/************************************/
545REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file);
546void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
547uint32                regfi_read(int fd, uint8* buf, uint32* length);
548
549const char*           regfi_type_val2str(unsigned int val);
550int                   regfi_type_str2val(const char* str);
551
552char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
553char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
554char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
555char*                 regfi_get_group(WINSEC_DESC* sec_desc);
556
557REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16 num_lists, 
558                                              REGFI_SUBKEY_LIST** lists,
559                                              bool strict);
560REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
561                                                uint32 max_size, bool strict,
562                                                uint8 depth_left);
563void                  regfi_add_message(REGFI_FILE* file, uint16 msg_type, 
564                                        const char* fmt, ...);
565REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
566REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
567
568#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.