Context Navigation

source: trunk/include/regfi.h @ 160

Last change on this file since 160 was 160, checked in by tim, 14 years ago
reorganized classname parsing and interpretation code
Property svn:keywords set to `Id`
File size: 22.5 KB

Line
1	/*
2	* Branched from Samba project Subversion repository, version #6903:
3	* http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4	*
5	* Windows NT (and later) registry parsing library
6	*
7	* Copyright (C) 2005-2009 Timothy D. Morgan
8	* Copyright (C) 2005 Gerald (Jerry) Carter
9	*
10	* This program is free software; you can redistribute it and/or modify
11	* it under the terms of the GNU General Public License as published by
12	* the Free Software Foundation; version 3 of the License.
13	*
14	* This program is distributed in the hope that it will be useful,
15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	* GNU General Public License for more details.
18	*
19	* You should have received a copy of the GNU General Public License
20	* along with this program; if not, write to the Free Software
21	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22	*
23	* $Id: regfi.h 160 2009-12-07 01:00:58Z tim $
24	*/
25
26	/************************************************************
27	* Most of this information was obtained from
28	* http://www.wednesday.demon.co.uk/dosreg.html
29	* Thanks Nigel!
30	***********************************************************/
31
32	#ifndef _REGFI_H
33	#define _REGFI_H
34
35	#include <stdlib.h>
36	#include <stdio.h>
37	#include <stdbool.h>
38	#include <stdarg.h>
39	#include <string.h>
40	#include <errno.h>
41	#include <time.h>
42	#include <fcntl.h>
43	#include <sys/stat.h>
44	#include <sys/types.h>
45	#include <unistd.h>
46	#include <assert.h>
47	#include <iconv.h>
48
49	#include "talloc.h"
50	#include "smb_deps.h"
51	#include "winsec.h"
52	#include "void_stack.h"
53	#include "range_list.h"
54	#include "lru_cache.h"
55
56	/******************************************************************************/
57
58	/* regfi library error message types */
59	#define REGFI_MSG_INFO 0x0001
60	#define REGFI_MSG_WARN 0x0004
61	#define REGFI_MSG_ERROR 0x0010
62
63	/* Windows is lame */
64	#ifdef O_BINARY
65	#define REGFI_OPEN_FLAGS O_RDONLY\|O_BINARY
66	#else
67	#define REGFI_OPEN_FLAGS O_RDONLY
68	#endif
69
70	/* Registry data types */
71	#define REG_NONE 0
72	#define REG_SZ 1
73	#define REG_EXPAND_SZ 2
74	#define REG_BINARY 3
75	#define REG_DWORD 4
76	#define REG_DWORD_LE 4 /* DWORD, little endian */
77	#define REG_DWORD_BE 5 /* DWORD, big endian */
78	#define REG_LINK 6
79	#define REG_MULTI_SZ 7
80	#define REG_RESOURCE_LIST 8
81	#define REG_FULL_RESOURCE_DESCRIPTOR 9
82	#define REG_RESOURCE_REQUIREMENTS_LIST 10
83	#define REG_QWORD 11 /* 64-bit little endian */
84	/* XXX: Has MS defined a REG_QWORD_BE? */
85	/* Not a real type in the registry */
86	#define REG_KEY 0x7FFFFFFF
87
88	#define REGFI_MAX_DEPTH 512
89	#define REGFI_OFFSET_NONE 0xffffffff
90
91	/* XXX: This is totally arbitrary right now. */
92	#define REGFI_MAX_SUBKEY_DEPTH 255
93
94	/* Header sizes and magic number lengths for various records */
95	#define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */
96	#define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */
97	#define REGFI_REGF_MAGIC_SIZE 4
98	#define REGFI_REGF_NAME_SIZE 64
99	#define REGFI_REGF_RESERVED1_SIZE 340
100	#define REGFI_REGF_RESERVED2_SIZE 3528
101	#define REGFI_HBIN_MAGIC_SIZE 4
102	#define REGFI_CELL_MAGIC_SIZE 2
103	#define REGFI_HBIN_HEADER_SIZE 0x20
104	#define REGFI_NK_MIN_LENGTH 0x4C
105	#define REGFI_VK_MIN_LENGTH 0x14
106	#define REGFI_SK_MIN_LENGTH 0x14
107	#define REGFI_SUBKEY_LIST_MIN_LEN 0x4
108	#define REGFI_BIG_DATA_MIN_LENGTH 0xC
109
110
111	/* Constants used for validation */
112	/* XXX: Can we add clock resolution validation as well as range? It has
113	* been reported that Windows timestamps are never more than a
114	* certain granularity (250ms?), which could be used to help
115	* eliminate false positives. Would need to verify this and
116	* perhaps conservatively implement a check.
117	*/
118	/* Minimum time is Jan 1, 1990 00:00:00 */
119	#define REGFI_MTIME_MIN_HIGH 0x01B41E6D
120	#define REGFI_MTIME_MIN_LOW 0x26F98000
121	/* Maximum time is Jan 1, 2290 00:00:00
122	* (We hope no one is using Windows by then...)
123	*/
124	#define REGFI_MTIME_MAX_HIGH 0x03047543
125	#define REGFI_MTIME_MAX_LOW 0xC80A4000
126
127
128	/* Flags for the vk records */
129	/* XXX: This next flag may be incorrect. According to Jeffrey Muir,
130	* this may actually indicate that the value name is stored in
131	* UTF-16LE.
132	*/
133	#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
134	#define REGFI_VK_DATA_IN_OFFSET 0x80000000
135	#define REGFI_VK_MAX_DATA_LENGTH 10241024 / XXX: This is arbitrary */
136
137
138	/* Known key flags */
139	/*******************/
140	/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
141	#define REGFI_NK_FLAG_UNKNOWN1 0x4000
142	#define REGFI_NK_FLAG_UNKNOWN2 0x1000
143
144	/* This next one shows up on root keys in some Vista "software" registries */
145	#define REGFI_NK_FLAG_UNKNOWN3 0x0080
146
147	/* Predefined handle. Rumor has it that the valuelist count for this key is
148	* where the handle is stored.
149	* http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
150	*/
151	#define REGFI_NK_FLAG_PREDEF_KEY 0x0040
152
153	/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
154	#define REGFI_NK_FLAG_ASCIINAME 0x0020
155
156	/* Symlink key.
157	* See: http://www.codeproject.com/KB/system/regsymlink.aspx
158	*/
159	#define REGFI_NK_FLAG_LINK 0x0010
160
161	/* This key cannot be deleted */
162	#define REGFI_NK_FLAG_NO_RM 0x0008
163
164	/* Root of a hive */
165	#define REGFI_NK_FLAG_ROOT 0x0004
166
167	/* Mount point of another hive. NULL/(default) value indicates which hive
168	* and where in the hive it points to.
169	*/
170	#define REGFI_NK_FLAG_HIVE_LINK 0x0002
171
172	/* These keys shouldn't be stored on disk, according to:
173	* http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
174	*/
175	#define REGFI_NK_FLAG_VOLATILE 0x0001
176
177	/* Useful for identifying unknown flag types */
178	#define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\
179	\| REGFI_NK_FLAG_ASCIINAME\
180	\| REGFI_NK_FLAG_LINK\
181	\| REGFI_NK_FLAG_NO_RM\
182	\| REGFI_NK_FLAG_ROOT\
183	\| REGFI_NK_FLAG_HIVE_LINK\
184	\| REGFI_NK_FLAG_VOLATILE\
185	\| REGFI_NK_FLAG_UNKNOWN1\
186	\| REGFI_NK_FLAG_UNKNOWN2)
187
188	/* HBIN block */
189	typedef struct _regfi_hbin
190	{
191	uint32 file_off; /* my offset in the registry file */
192	uint32 ref_count; /* how many active records are pointing to this
193	* block (not used currently)
194	*/
195
196	uint32 first_hbin_off; /* offset from first hbin block */
197	uint32 block_size; /* block size of this block
198	* Should be a multiple of 4096 (0x1000)
199	*/
200	uint32 next_block; /* relative offset to next block.
201	* NOTE: This value may be unreliable!
202	*/
203
204	uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
205	} REGFI_HBIN;
206
207
208	/* Subkey List -- list of key offsets and hashed names for consistency */
209	typedef struct
210	{
211	/* Virtual offset of NK record or additional subkey list,
212	* depending on this list's type.
213	*/
214	uint32 offset;
215
216	uint32 hash;
217	} REGFI_SUBKEY_LIST_ELEM;
218
219
220	typedef struct _regfi_subkey_list
221	{
222	/* Real offset of this record's cell in the file */
223	uint32 offset;
224
225	uint32 cell_size;
226
227	/* Number of immediate children */
228	uint32 num_children;
229
230	/* Total number of keys referenced by this list and it's children */
231	uint32 num_keys;
232
233	REGFI_SUBKEY_LIST_ELEM* elements;
234	uint8 magic[REGFI_CELL_MAGIC_SIZE];
235
236	/* Set if the magic indicates this subkey list points to child subkey lists */
237	bool recursive_type;
238	} REGFI_SUBKEY_LIST;
239
240
241	typedef uint32 REGFI_VALUE_LIST_ELEM;
242	typedef struct _regfi_value_list
243	{
244	/* Actual number of values referenced by this list.
245	* May differ from parent key's num_values if there were parsing errors.
246	*/
247	uint32 num_values;
248
249	REGFI_VALUE_LIST_ELEM* elements;
250	} REGFI_VALUE_LIST;
251
252
253	typedef struct _regfi_classname
254	{
255	/* As converted to requested character encoding. */
256	char* interpreted;
257
258	/* Represents raw buffer read from classname cell. */
259	uint8* raw;
260
261	/* Length of the raw data. May be shorter than that indicated by parent key.*/
262	uint16 size;
263	} REGFI_CLASSNAME;
264
265
266	typedef struct _regfi_data
267	{
268	uint32 type;
269
270	/* Length of the raw data. */
271	uint32 size;
272
273	/* This is always present, representing the raw data cell contents. */
274	uint8* raw;
275
276	/* Represents the length of the interpreted value. Meaning is type-specific.*/
277	uint32 interpreted_size;
278
279	/* These items represent interpreted versions of the raw attribute above.
280	* Only use the appropriate member according to the type field.
281	* In the event of an unknown type, use only the raw field.
282	*/
283	union _regfi_data_interpreted
284	{
285	uint8* none; /* */
286	uint8* string;
287	uint8* expand_string;
288	uint8* binary; /* */
289	uint32 dword;
290	uint32 dword_be;
291	uint8* link;
292	uint8** multiple_string;
293	uint64 qword;
294
295	/* The following are treated as binary currently, but this may change in
296	* the future as the formats become better understood.
297	*/
298	uint8* resource_list;
299	uint8* full_resource_descriptor;
300	uint8* resource_requirements_list;
301	} interpreted;
302	} REGFI_DATA;
303
304
305	/* Value record */
306	typedef struct
307	{
308	uint32 offset; /* Real offset of this record's cell in the file */
309	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
310
311	REGFI_DATA* data; /* XXX: deprecated */
312
313	char* valuename;
314	uint8* valuename_raw;
315	uint16 name_length;
316	uint32 hbin_off; /* offset from beginning of this hbin block */
317
318	uint32 data_size; /* As reported in the VK record. May be different than
319	* That obtained while parsing the data cell itself. */
320	uint32 data_off; /* Offset of data cell (virtual) */
321	uint32 type;
322	uint8 magic[REGFI_CELL_MAGIC_SIZE];
323	uint16 flag;
324	uint16 unknown1;
325	bool data_in_offset;
326	} REGFI_VK_REC;
327
328
329	/* Key Security */
330	struct _regfi_sk_rec;
331
332	typedef struct _regfi_sk_rec
333	{
334	uint32 offset; /* Real file offset of this record */
335	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
336
337	WINSEC_DESC* sec_desc;
338	uint32 hbin_off; /* offset from beginning of this hbin block */
339
340	uint32 prev_sk_off;
341	uint32 next_sk_off;
342	uint32 ref_count;
343	uint32 desc_size; /* size of security descriptor */
344	uint16 unknown_tag;
345	uint8 magic[REGFI_CELL_MAGIC_SIZE];
346	} REGFI_SK_REC;
347
348
349	/* Key Name */
350	typedef struct
351	{
352	uint32 offset; /* Real offset of this record's cell in the file */
353	uint32 cell_size; /* Actual or estimated length of the cell.
354	* Always in multiples of 8.
355	*/
356
357	/* link in the other records here */
358	REGFI_VALUE_LIST* values;
359	REGFI_SUBKEY_LIST* subkeys;
360
361	/* header information */
362	uint16 key_type;
363	uint8 magic[REGFI_CELL_MAGIC_SIZE];
364	NTTIME mtime;
365	uint16 name_length;
366	uint16 classname_length;
367	char* keyname;
368	uint8* keyname_raw;
369	uint32 parent_off; /* pointer to parent key */
370	uint32 classname_off;
371
372	/* max lengths */
373	uint32 max_bytes_subkeyname; /* max subkey name * 2 */
374	uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
375	uint32 max_bytes_valuename; /* max valuename * 2 */
376	uint32 max_bytes_value; /* max value data size */
377
378	/* unknowns */
379	uint32 unknown1;
380	uint32 unknown2;
381	uint32 unknown3;
382	uint32 unk_index; /* nigel says run time index ? */
383
384	/* children */
385	uint32 num_subkeys;
386	uint32 subkeys_off; /* offset of subkey list that points to NK records */
387	uint32 num_values;
388	uint32 values_off; /* value lists which point to VK records */
389	uint32 sk_off; /* offset to SK record */
390	} REGFI_NK_REC;
391
392
393
394	/* REGF block */
395	typedef struct
396	{
397	/* Run-time information */
398	/************************/
399	/* file descriptor */
400	int fd;
401
402	/* For sanity checking (not part of the registry header) */
403	uint32 file_length;
404
405	/* Metadata about hbins */
406	range_list* hbins;
407
408	/* SK record cached since they're repeatedly reused */
409	lru_cache* sk_cache;
410
411	/* Error/warning/info messages returned by lower layer functions */
412	char* last_message;
413
414	/* Mask for error message types that will be stored. */
415	uint16 msg_mask;
416
417
418	/* Data parsed from file header */
419	/********************************/
420	uint8 magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
421
422	/* These sequence numbers should match if
423	* the hive was properly synced to disk.
424	*/
425	uint32 sequence1;
426	uint32 sequence2;
427
428	NTTIME mtime;
429	uint32 major_version; /* Set to 1 in all known hives */
430	uint32 minor_version; /* Set to 3 or 5 in all known hives */
431	uint32 type; /* XXX: Unverified. Set to 0 in all known hives */
432	uint32 format; /* XXX: Unverified. Set to 1 in all known hives */
433
434	uint32 root_cell; /* Offset to root cell in the first (or any?) hbin block */
435	uint32 last_block; /* Offset to last hbin block in file */
436
437	uint32 cluster; /* XXX: Unverified. Set to 1 in all known hives */
438
439	/* Matches hive's base file name. Stored in UTF-16LE */
440	uint8 file_name[REGFI_REGF_NAME_SIZE];
441
442	WINSEC_UUID* rm_id; /* XXX: Unverified. */
443	WINSEC_UUID* log_id; /* XXX: Unverified. */
444	WINSEC_UUID* tm_id; /* XXX: Unverified. */
445	uint32 flags; /* XXX: Unverified. */
446	uint32 guid_signature; /* XXX: Unverified. */
447
448	uint32 checksum; /* Stored checksum from file */
449	uint32 computed_checksum; /* Our own calculation of the checksum.
450	* (XOR of bytes 0x0000 - 0x01FB) */
451
452	WINSEC_UUID* thaw_tm_id; /* XXX: Unverified. */
453	WINSEC_UUID* thaw_rm_id; /* XXX: Unverified. */
454	WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
455	uint32 boot_type; /* XXX: Unverified. */
456	uint32 boot_recover; /* XXX: Unverified. */
457
458	/* This seems to include random junk. Possibly unsanitized memory left over
459	* from when header block was written. For instance, chunks of nk records
460	* can be found, though often it's all 0s. */
461	uint8 reserved1[REGFI_REGF_RESERVED1_SIZE];
462
463	/* This is likely reserved and unusued currently. (Should be all 0s.)
464	* Included here for easier access in looking for hidden data
465	* or doing research. */
466	uint8 reserved2[REGFI_REGF_RESERVED2_SIZE];
467
468	} REGFI_FILE;
469
470
471	/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
472	* structure, probably REGFI_FILE. Once key caching is in place,
473	* convert key_positions stack to store just key offsets rather than
474	* whole keys.
475	*/
476	typedef struct _regfi_iterator
477	{
478	REGFI_FILE* f;
479	void_stack* key_positions;
480	REGFI_NK_REC* cur_key;
481	const char* string_encoding;
482	uint32 cur_subkey;
483	uint32 cur_value;
484	} REGFI_ITERATOR;
485
486
487	typedef struct _regfi_iter_position
488	{
489	REGFI_NK_REC* nk;
490	uint32 cur_subkey;
491	/* We could store a cur_value here as well, but didn't see
492	* the use in it right now.
493	*/
494	} REGFI_ITER_POSITION;
495
496
497	typedef struct _regfi_buffer
498	{
499	uint8* buf;
500	uint32_t len;
501	} REGFI_BUFFER;
502
503
504
505
506	/******************************************************************************/
507	/* Main iterator API */
508	/******************************************************************************/
509	REGFI_FILE* regfi_open(const char* filename);
510	int regfi_close(REGFI_FILE* r);
511
512	/* regfi_get_messages: Get errors, warnings, and/or verbose information
513	* relating to processing of the given registry file.
514	*
515	* Arguments:
516	* file -- the structure for the registry file
517	*
518	* Returns:
519	* A newly allocated char* which must be free()d by the caller.
520	*/
521	char* regfi_get_messages(REGFI_FILE* file);
522
523	void regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
524
525
526	/* regfi_iterator_new: Creates a new iterator for the provided registry file.
527	*
528	* Arguments:
529	* file -- The opened registry file the iterator should be
530	* created for.
531	* output_encoding -- An integer representing the output string encoding.
532	* These integers currently map to a specific set of
533	* iconv(3) encodings.
534	* The following values are currently accepted:
535	* 0 - default (currently US-ASCII//TRANSLIT)
536	* 1 - US-ASCII//TRANSLIT
537	* 2 - UTF-8//TRANSLIT
538	*
539	* XXX: This encoding only applies to specific data
540	* strings currently, but should apply to key
541	* names and value names in the future.
542	*
543	* Returns:
544	* A newly allocated REGFI_ITERATOR. Must be free()d with regfi_iterator_free.
545	*/
546	REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* file,
547	uint32 output_encoding);
548	void regfi_iterator_free(REGFI_ITERATOR* i);
549	bool regfi_iterator_down(REGFI_ITERATOR* i);
550	bool regfi_iterator_up(REGFI_ITERATOR* i);
551	bool regfi_iterator_to_root(REGFI_ITERATOR* i);
552
553	bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
554	const char** path);
555	const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
556	const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
557
558	REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
559	REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
560	REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
561	bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
562	const char* subkey_name);
563
564	REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
565	REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
566	REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
567	bool regfi_iterator_find_value(REGFI_ITERATOR* i,
568	const char* value_name);
569
570	REGFI_CLASSNAME* regfi_iterator_fetch_classname(REGFI_ITERATOR* i,
571	const REGFI_NK_REC* key);
572	REGFI_DATA* regfi_iterator_fetch_data(REGFI_ITERATOR* i,
573	const REGFI_VK_REC* value);
574
575
576	/********************************************************/
577	/* Middle-layer structure loading, linking, and caching */
578	/********************************************************/
579	REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32 offset,
580	bool strict);
581	REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32 offset,
582	bool strict);
583	REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
584	uint32 num_keys, uint32 max_size,
585	bool strict);
586	REGFI_VALUE_LIST* regfi_load_valuelist(REGFI_FILE* file, uint32 offset,
587	uint32 num_values, uint32 max_size,
588	bool strict);
589
590	REGFI_BUFFER regfi_load_data(REGFI_FILE* file, uint32 voffset,
591	uint32 length, bool data_in_offset,
592	bool strict);
593
594	REGFI_BUFFER regfi_load_big_data(REGFI_FILE* file, uint32 offset,
595	uint32 data_length,uint32 cell_length,
596	range_list* used_ranges,
597	bool strict);
598	bool regfi_interpret_data(REGFI_FILE* file,
599	const char* string_encoding,
600	uint32 type, REGFI_DATA* data);
601	void regfi_free_classname(REGFI_CLASSNAME* classname);
602	void regfi_free_data(REGFI_DATA* data);
603
604
605	/* These are cached so return values don't need to be freed. */
606	const REGFI_SK_REC* regfi_load_sk(REGFI_FILE* file, uint32 offset,
607	bool strict);
608	const REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
609
610
611	/************************************/
612	/* Low-layer data structure access */
613	/************************************/
614	REGFI_FILE* regfi_parse_regf(int fd, bool strict);
615	REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32 offset,
616	bool strict);
617
618
619	/* regfi_parse_nk: Parses an NK record.
620	*
621	* Arguments:
622	* f -- the registry file structure
623	* offset -- the offset of the cell (not the record) to be parsed.
624	* max_size -- the maximum size the NK cell could be. (for validation)
625	* strict -- if true, rejects any malformed records. Otherwise,
626	* tries to minimally validate integrity.
627	* Returns:
628	* A newly allocated NK record structure, or NULL on failure.
629	*/
630	REGFI_NK_REC* regfi_parse_nk(REGFI_FILE* file, uint32 offset,
631	uint32 max_size, bool strict);
632
633	REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
634	uint32 max_size, bool strict);
635
636	REGFI_VK_REC* regfi_parse_vk(REGFI_FILE* file, uint32 offset,
637	uint32 max_size, bool strict);
638
639	REGFI_SK_REC* regfi_parse_sk(REGFI_FILE* file, uint32 offset,
640	uint32 max_size, bool strict);
641
642	range_list* regfi_parse_unalloc_cells(REGFI_FILE* file);
643
644	bool regfi_parse_cell(int fd, uint32 offset,
645	uint8* hdr, uint32 hdr_len,
646	uint32* cell_length, bool* unalloc);
647
648	uint8* regfi_parse_classname(REGFI_FILE* file, uint32 offset,
649	uint16* name_length,
650	uint32 max_size, bool strict);
651
652	REGFI_BUFFER regfi_parse_data(REGFI_FILE* file, uint32 offset,
653	uint32 length, bool strict);
654
655	REGFI_BUFFER regfi_parse_little_data(REGFI_FILE* file, uint32 voffset,
656	uint32 length, bool strict);
657
658
659	/* Dispose of previously parsed records */
660	void regfi_free_key(REGFI_NK_REC* nk);
661	void regfi_free_value(REGFI_VK_REC* vk);
662
663
664
665	/************************************/
666	/* Private Functions */
667	/************************************/
668	REGFI_NK_REC* regfi_rootkey(REGFI_FILE* file);
669	void regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
670	uint32 regfi_read(int fd, uint8* buf, uint32* length);
671
672	const char* regfi_type_val2str(unsigned int val);
673	int regfi_type_str2val(const char* str);
674
675	char* regfi_get_sacl(WINSEC_DESC* sec_desc);
676	char* regfi_get_dacl(WINSEC_DESC* sec_desc);
677	char* regfi_get_owner(WINSEC_DESC* sec_desc);
678	char* regfi_get_group(WINSEC_DESC* sec_desc);
679
680	REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists,
681	REGFI_SUBKEY_LIST** lists,
682	bool strict);
683	REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
684	uint32 max_size, bool strict,
685	uint8 depth_left);
686	void regfi_add_message(REGFI_FILE* file, uint16 msg_type,
687	const char* fmt, ...);
688	REGFI_NK_REC* regfi_copy_nk(const REGFI_NK_REC* nk);
689	REGFI_VK_REC* regfi_copy_vk(const REGFI_VK_REC* vk);
690	int32 regfi_calc_maxsize(REGFI_FILE* file, uint32 offset);
691	int32 regfi_conv_charset(const char* output_charset,
692	uint8* input, char* output,
693	uint32 input_len, uint32 output_max);
694	REGFI_DATA* regfi_buffer_to_data(REGFI_BUFFER raw_data);
695
696	#endif /* _REGFI_H */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: