Context Navigation

source: trunk/include/regfi.h @ 166

Last change on this file since 166 was 166, checked in by tim, 14 years ago
fixed a bug in big data parsing broke up some of REGFI_FILE initialization started added more regfi API documentation
Property svn:keywords set to `Id`
File size: 28.0 KB

Line
1	/*
2	* Branched from Samba project Subversion repository, version #6903:
3	* http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
4	*
5	* Windows NT (and later) registry parsing library
6	*
7	* Copyright (C) 2005-2009 Timothy D. Morgan
8	* Copyright (C) 2005 Gerald (Jerry) Carter
9	*
10	* This program is free software; you can redistribute it and/or modify
11	* it under the terms of the GNU General Public License as published by
12	* the Free Software Foundation; version 3 of the License.
13	*
14	* This program is distributed in the hope that it will be useful,
15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	* GNU General Public License for more details.
18	*
19	* You should have received a copy of the GNU General Public License
20	* along with this program; if not, write to the Free Software
21	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22	*
23	* $Id: regfi.h 166 2009-12-16 03:18:05Z tim $
24	*/
25
26	/************************************************************
27	* Most of this information was obtained from
28	* http://www.wednesday.demon.co.uk/dosreg.html
29	* Thanks Nigel!
30	***********************************************************/
31
32	#ifndef _REGFI_H
33	#define _REGFI_H
34
35	#include <stdlib.h>
36	#include <stdio.h>
37	#include <stdbool.h>
38	#include <stdarg.h>
39	#include <string.h>
40	#include <errno.h>
41	#include <time.h>
42	#include <fcntl.h>
43	#include <sys/stat.h>
44	#include <sys/types.h>
45	#include <unistd.h>
46	#include <assert.h>
47	#include <iconv.h>
48
49	#include "talloc.h"
50	#include "smb_deps.h"
51	#include "winsec.h"
52	#include "void_stack.h"
53	#include "range_list.h"
54	#include "lru_cache.h"
55
56	/******************************************************************************/
57
58	/* regfi library error message types */
59	#define REGFI_MSG_INFO 0x0001
60	#define REGFI_MSG_WARN 0x0004
61	#define REGFI_MSG_ERROR 0x0010
62
63	typedef uint8 REGFI_ENCODING;
64	/* regfi library supported character encodings */
65	#define REGFI_ENCODING_ASCII 0
66	#define REGFI_ENCODING_UTF8 1
67	#define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII
68	/* UTF16LE is not supported for output */
69	#define REGFI_ENCODING_UTF16LE 2
70
71	#define REGFI_NUM_ENCODINGS 3
72
73	/* Windows is lame */
74	#ifdef O_BINARY
75	#define REGFI_OPEN_FLAGS O_RDONLY\|O_BINARY
76	#else
77	#define REGFI_OPEN_FLAGS O_RDONLY
78	#endif
79
80	/* Registry data types */
81	#define REG_NONE 0
82	#define REG_SZ 1
83	#define REG_EXPAND_SZ 2
84	#define REG_BINARY 3
85	#define REG_DWORD 4
86	#define REG_DWORD_LE 4 /* DWORD, little endian */
87	#define REG_DWORD_BE 5 /* DWORD, big endian */
88	#define REG_LINK 6
89	#define REG_MULTI_SZ 7
90	#define REG_RESOURCE_LIST 8
91	#define REG_FULL_RESOURCE_DESCRIPTOR 9
92	#define REG_RESOURCE_REQUIREMENTS_LIST 10
93	#define REG_QWORD 11 /* 64-bit little endian */
94	/* XXX: Has MS defined a REG_QWORD_BE? */
95	/* Not a real type in the registry */
96	#define REG_KEY 0x7FFFFFFF
97
98	#define REGFI_OFFSET_NONE 0xffffffff
99
100
101	/* This maximum depth is described here:
102	* http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
103	*/
104	#define REGFI_MAX_DEPTH 512
105
106	/* This limit defines the maximum number of levels deep that ri subkey list
107	* trees can go.
108	*/
109	/* XXX: This is totally arbitrary right now.
110	* The actual limit may need to be discovered by experimentation.
111	*/
112	#define REGFI_MAX_SUBKEY_DEPTH 255
113
114
115	/* Header sizes and magic number lengths for various records */
116	#define REGFI_HBIN_ALLOC 0x1000 /* Minimum allocation unit for HBINs */
117	#define REGFI_REGF_SIZE 0x1000 /* "regf" header block size */
118	#define REGFI_REGF_MAGIC_SIZE 4
119	#define REGFI_REGF_NAME_SIZE 64
120	#define REGFI_REGF_RESERVED1_SIZE 340
121	#define REGFI_REGF_RESERVED2_SIZE 3528
122	#define REGFI_HBIN_MAGIC_SIZE 4
123	#define REGFI_CELL_MAGIC_SIZE 2
124	#define REGFI_HBIN_HEADER_SIZE 0x20
125	#define REGFI_NK_MIN_LENGTH 0x4C
126	#define REGFI_VK_MIN_LENGTH 0x14
127	#define REGFI_SK_MIN_LENGTH 0x14
128	#define REGFI_SUBKEY_LIST_MIN_LEN 0x4
129	#define REGFI_BIG_DATA_MIN_LENGTH 0xC
130
131
132	/* Constants used for validation */
133	/* XXX: Can we add clock resolution validation as well as range? It has
134	* been reported that Windows timestamps are never more than a
135	* certain granularity (250ms?), which could be used to help
136	* eliminate false positives. Would need to verify this and
137	* perhaps conservatively implement a check.
138	*/
139	/* Minimum time is Jan 1, 1990 00:00:00 */
140	#define REGFI_MTIME_MIN_HIGH 0x01B41E6D
141	#define REGFI_MTIME_MIN_LOW 0x26F98000
142	/* Maximum time is Jan 1, 2290 00:00:00
143	* (We hope no one is using Windows by then...)
144	*/
145	#define REGFI_MTIME_MAX_HIGH 0x03047543
146	#define REGFI_MTIME_MAX_LOW 0xC80A4000
147
148
149	/* Flags for the vk records */
150	#define REGFI_VK_FLAG_ASCIINAME 0x0001
151	#define REGFI_VK_DATA_IN_OFFSET 0x80000000
152	#define REGFI_VK_MAX_DATA_LENGTH 10241024 / XXX: This is arbitrary */
153
154
155	/* Known key flags */
156	/*******************/
157	/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
158	#define REGFI_NK_FLAG_UNKNOWN1 0x4000
159	#define REGFI_NK_FLAG_UNKNOWN2 0x1000
160
161	/* This next one shows up on root keys in some Vista "software" registries */
162	#define REGFI_NK_FLAG_UNKNOWN3 0x0080
163
164	/* Predefined handle. Rumor has it that the valuelist count for this key is
165	* where the handle is stored.
166	* http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
167	*/
168	#define REGFI_NK_FLAG_PREDEF_KEY 0x0040
169
170	/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
171	#define REGFI_NK_FLAG_ASCIINAME 0x0020
172
173	/* Symlink key.
174	* See: http://www.codeproject.com/KB/system/regsymlink.aspx
175	*/
176	#define REGFI_NK_FLAG_LINK 0x0010
177
178	/* This key cannot be deleted */
179	#define REGFI_NK_FLAG_NO_RM 0x0008
180
181	/* Root of a hive */
182	#define REGFI_NK_FLAG_ROOT 0x0004
183
184	/* Mount point of another hive. NULL/(default) value indicates which hive
185	* and where in the hive it points to.
186	*/
187	#define REGFI_NK_FLAG_HIVE_LINK 0x0002
188
189	/* These keys shouldn't be stored on disk, according to:
190	* http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
191	*/
192	#define REGFI_NK_FLAG_VOLATILE 0x0001
193
194	/* Useful for identifying unknown flag types */
195	#define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\
196	\| REGFI_NK_FLAG_ASCIINAME\
197	\| REGFI_NK_FLAG_LINK\
198	\| REGFI_NK_FLAG_NO_RM\
199	\| REGFI_NK_FLAG_ROOT\
200	\| REGFI_NK_FLAG_HIVE_LINK\
201	\| REGFI_NK_FLAG_VOLATILE\
202	\| REGFI_NK_FLAG_UNKNOWN1\
203	\| REGFI_NK_FLAG_UNKNOWN2)
204
205	/* HBIN block */
206	typedef struct _regfi_hbin
207	{
208	uint32 file_off; /* my offset in the registry file */
209	uint32 ref_count; /* how many active records are pointing to this
210	* block (not used currently)
211	*/
212
213	uint32 first_hbin_off; /* offset from first hbin block */
214	uint32 block_size; /* block size of this block
215	* Should be a multiple of 4096 (0x1000)
216	*/
217	uint32 next_block; /* relative offset to next block.
218	* NOTE: This value may be unreliable!
219	*/
220
221	uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
222	} REGFI_HBIN;
223
224
225	/* Subkey List -- list of key offsets and hashed names for consistency */
226	typedef struct
227	{
228	/* Virtual offset of NK record or additional subkey list,
229	* depending on this list's type.
230	*/
231	uint32 offset;
232
233	uint32 hash;
234	} REGFI_SUBKEY_LIST_ELEM;
235
236
237	typedef struct _regfi_subkey_list
238	{
239	/* Real offset of this record's cell in the file */
240	uint32 offset;
241
242	uint32 cell_size;
243
244	/* Number of immediate children */
245	uint32 num_children;
246
247	/* Total number of keys referenced by this list and it's children */
248	uint32 num_keys;
249
250	REGFI_SUBKEY_LIST_ELEM* elements;
251	uint8 magic[REGFI_CELL_MAGIC_SIZE];
252
253	/* Set if the magic indicates this subkey list points to child subkey lists */
254	bool recursive_type;
255	} REGFI_SUBKEY_LIST;
256
257
258	typedef uint32 REGFI_VALUE_LIST_ELEM;
259	typedef struct _regfi_value_list
260	{
261	/* Actual number of values referenced by this list.
262	* May differ from parent key's num_values if there were parsing errors.
263	*/
264	uint32 num_values;
265
266	REGFI_VALUE_LIST_ELEM* elements;
267	} REGFI_VALUE_LIST;
268
269
270	typedef struct _regfi_classname
271	{
272	/* As converted to requested character encoding. */
273	char* interpreted;
274
275	/* Represents raw buffer read from classname cell. */
276	uint8* raw;
277
278	/* Length of the raw data. May be shorter than that indicated by parent key.*/
279	uint16 size;
280	} REGFI_CLASSNAME;
281
282
283	typedef struct _regfi_data
284	{
285	uint32 type;
286
287	/* Length of the raw data. */
288	uint32 size;
289
290	/* This is always present, representing the raw data cell contents. */
291	uint8* raw;
292
293	/* Represents the length of the interpreted value. Meaning is type-specific.*/
294	uint32 interpreted_size;
295
296	/* These items represent interpreted versions of the raw attribute above.
297	* Only use the appropriate member according to the type field.
298	* In the event of an unknown type, use only the raw field.
299	*/
300	union _regfi_data_interpreted
301	{
302	uint8* none; /* */
303	uint8* string;
304	uint8* expand_string;
305	uint8* binary; /* */
306	uint32 dword;
307	uint32 dword_be;
308	uint8* link;
309	uint8** multiple_string;
310	uint64 qword;
311
312	/* The following are treated as binary currently, but this may change in
313	* the future as the formats become better understood.
314	*/
315	uint8* resource_list;
316	uint8* full_resource_descriptor;
317	uint8* resource_requirements_list;
318	} interpreted;
319	} REGFI_DATA;
320
321
322	/* Value record */
323	typedef struct
324	{
325	uint32 offset; /* Real offset of this record's cell in the file */
326	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
327
328	REGFI_DATA* data; /* XXX: deprecated */
329
330	char* valuename;
331	uint8* valuename_raw;
332	uint16 name_length;
333	uint32 hbin_off; /* offset from beginning of this hbin block */
334
335	uint32 data_size; /* As reported in the VK record. May be different than
336	* That obtained while parsing the data cell itself. */
337	uint32 data_off; /* Offset of data cell (virtual) */
338	uint32 type;
339	uint8 magic[REGFI_CELL_MAGIC_SIZE];
340	uint16 flags;
341	uint16 unknown1;
342	bool data_in_offset;
343	} REGFI_VK_REC;
344
345
346	/* Key Security */
347	struct _regfi_sk_rec;
348
349	typedef struct _regfi_sk_rec
350	{
351	uint32 offset; /* Real file offset of this record */
352	uint32 cell_size; /* ((start_offset - end_offset) & 0xfffffff8) */
353
354	WINSEC_DESC* sec_desc;
355	uint32 hbin_off; /* offset from beginning of this hbin block */
356
357	uint32 prev_sk_off;
358	uint32 next_sk_off;
359	uint32 ref_count;
360	uint32 desc_size; /* size of security descriptor */
361	uint16 unknown_tag;
362	uint8 magic[REGFI_CELL_MAGIC_SIZE];
363	} REGFI_SK_REC;
364
365
366	/* Key Name */
367	typedef struct
368	{
369	uint32 offset; /* Real offset of this record's cell in the file */
370	uint32 cell_size; /* Actual or estimated length of the cell.
371	* Always in multiples of 8.
372	*/
373
374	/* link in the other records here */
375	REGFI_VALUE_LIST* values;
376	REGFI_SUBKEY_LIST* subkeys;
377
378	/* header information */
379	uint16 flags;
380	uint8 magic[REGFI_CELL_MAGIC_SIZE];
381	NTTIME mtime;
382	uint16 name_length;
383	uint16 classname_length;
384	char* keyname;
385	uint8* keyname_raw;
386	uint32 parent_off; /* pointer to parent key */
387	uint32 classname_off;
388
389	/* max lengths */
390	uint32 max_bytes_subkeyname; /* max subkey name * 2 */
391	uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
392	uint32 max_bytes_valuename; /* max valuename * 2 */
393	uint32 max_bytes_value; /* max value data size */
394
395	/* unknowns */
396	uint32 unknown1;
397	uint32 unknown2;
398	uint32 unknown3;
399	uint32 unk_index; /* nigel says run time index ? */
400
401	/* children */
402	uint32 num_subkeys;
403	uint32 subkeys_off; /* offset of subkey list that points to NK records */
404	uint32 num_values;
405	uint32 values_off; /* value lists which point to VK records */
406	uint32 sk_off; /* offset to SK record */
407	} REGFI_NK_REC;
408
409
410
411	/* REGF block */
412	typedef struct
413	{
414	/* Run-time information */
415	/************************/
416	/* file descriptor */
417	int fd;
418
419	/* For sanity checking (not part of the registry header) */
420	uint32 file_length;
421
422	/* Metadata about hbins */
423	range_list* hbins;
424
425	/* SK record cached since they're repeatedly reused */
426	lru_cache* sk_cache;
427
428	/* Error/warning/info messages returned by lower layer functions */
429	char* last_message;
430
431	/* Mask for error message types that will be stored. */
432	uint16 msg_mask;
433
434
435	/* Data parsed from file header */
436	/********************************/
437	uint8 magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
438
439	/* These sequence numbers should match if
440	* the hive was properly synced to disk.
441	*/
442	uint32 sequence1;
443	uint32 sequence2;
444
445	NTTIME mtime;
446	uint32 major_version; /* Set to 1 in all known hives */
447	uint32 minor_version; /* Set to 3 or 5 in all known hives */
448	uint32 type; /* XXX: Unverified. Set to 0 in all known hives */
449	uint32 format; /* XXX: Unverified. Set to 1 in all known hives */
450
451	uint32 root_cell; /* Offset to root cell in the first (or any?) hbin block */
452	uint32 last_block; /* Offset to last hbin block in file */
453
454	uint32 cluster; /* XXX: Unverified. Set to 1 in all known hives */
455
456	/* Matches hive's base file name. Stored in UTF-16LE */
457	uint8 file_name[REGFI_REGF_NAME_SIZE];
458
459	WINSEC_UUID* rm_id; /* XXX: Unverified. */
460	WINSEC_UUID* log_id; /* XXX: Unverified. */
461	WINSEC_UUID* tm_id; /* XXX: Unverified. */
462	uint32 flags; /* XXX: Unverified. */
463	uint32 guid_signature; /* XXX: Unverified. */
464
465	uint32 checksum; /* Stored checksum from file */
466	uint32 computed_checksum; /* Our own calculation of the checksum.
467	* (XOR of bytes 0x0000 - 0x01FB) */
468
469	WINSEC_UUID* thaw_tm_id; /* XXX: Unverified. */
470	WINSEC_UUID* thaw_rm_id; /* XXX: Unverified. */
471	WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
472	uint32 boot_type; /* XXX: Unverified. */
473	uint32 boot_recover; /* XXX: Unverified. */
474
475	/* This seems to include random junk. Possibly unsanitized memory left over
476	* from when header block was written. For instance, chunks of nk records
477	* can be found, though often it's all 0s. */
478	uint8 reserved1[REGFI_REGF_RESERVED1_SIZE];
479
480	/* This is likely reserved and unusued currently. (Should be all 0s.)
481	* Included here for easier access in looking for hidden data
482	* or doing research. */
483	uint8 reserved2[REGFI_REGF_RESERVED2_SIZE];
484
485	} REGFI_FILE;
486
487
488	typedef struct _regfi_iterator
489	{
490	REGFI_FILE* f;
491	void_stack* key_positions;
492	REGFI_NK_REC* cur_key;
493	REGFI_ENCODING string_encoding;
494	uint32 cur_subkey;
495	uint32 cur_value;
496	} REGFI_ITERATOR;
497
498
499	typedef struct _regfi_iter_position
500	{
501	REGFI_NK_REC* nk;
502	uint32 cur_subkey;
503	/* We could store a cur_value here as well, but didn't see
504	* the use in it right now.
505	*/
506	} REGFI_ITER_POSITION;
507
508
509	typedef struct _regfi_buffer
510	{
511	uint8* buf;
512	uint32_t len;
513	} REGFI_BUFFER;
514
515
516
517
518	/******************************************************************************/
519	/* Main iterator API */
520	/******************************************************************************/
521
522	/* regfi_open: Attempts to open a registry hive and allocate related data
523	* structures.
524	*
525	* Arguments:
526	* filename -- A string containing the relative or absolute path of the
527	* registry hive to be opened.
528	*
529	* Returns:
530	* A reference to a newly allocated REGFI_FILE structure, if successful.
531	* NULL on error.
532	*/
533	REGFI_FILE* regfi_open(const char* filename);
534
535
536	/* regfi_alloc: Parses file headers of an already open registry hive file and
537	* allocates related structures for further parsing.
538	*
539	* Arguments:
540	* fd -- A file descriptor of an already open file. Must be seekable.
541	*
542	* Returns:
543	* A reference to a newly allocated REGFI_FILE structure, if successful.
544	* NULL on error.
545	*/
546	REGFI_FILE* regfi_alloc(int fd);
547
548
549	/* regfi_close: Closes and frees an open registry hive.
550	*
551	* Arguments:
552	* file -- The registry structure to close.
553	*
554	* Returns:
555	* 0 on success, -1 on failure with errno set.
556	* errno codes are similar to those of close(2).
557	*/
558	int regfi_close(REGFI_FILE* file);
559
560
561	/* regfi_free: Frees a hive's data structures without closing the underlying
562	* file.
563	*
564	* Arguments:
565	* file -- The registry structure to free.
566	*/
567	void regfi_free(REGFI_FILE* file);
568
569
570	/* regfi_get_messages: Get errors, warnings, and/or verbose information
571	* relating to processing of the given registry file.
572	*
573	* Arguments:
574	* file -- the structure for the registry file
575	*
576	* Returns:
577	* A newly allocated char* which must be free()d by the caller.
578	*/
579	char* regfi_get_messages(REGFI_FILE* file);
580
581
582	/* regfi_set_message_mask: Set the verbosity level of errors and warnings
583	* generated by the library
584	* (as accessible via regfi_get_messages).
585	*
586	* Arguments:
587	* file -- the structure for the registry file
588	* mask -- an integer representing the types of messages desired.
589	* Acceptable values are created through bitwise ORs of
590	* REGFI_MSG_* values. For instance, if only errors and
591	* informational messages were desired (but not warnings),
592	* then one would specify: REGFI_MSG_ERROR\|REGFI_MSG_INFO
593	* New REGFI_FILE structures are created with:
594	* REGFI_MSG_ERROR\|REGFI_MSG_WARN
595	* Note that error and warning messages will continue to
596	* accumulate in memory if they are not fetched using
597	* regfi_get_messages and then freed by the caller.
598	* To disable error messages entirely, supply 0, which
599	* will prevent message accumulation.
600	*
601	* This may be called at any time and will take effect immediately.
602	*/
603	void regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
604
605
606	/* regfi_iterator_new: Creates a new iterator for the provided registry file.
607	*
608	* Arguments:
609	* file -- The opened registry file the iterator should be
610	* created for.
611	* output_encoding -- Character encoding that strings should be returned in.
612	* Only supply the REGFI_ENCODING_* constants, as others
613	* will be rejected.
614	* The following values are currently accepted:
615	* REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
616	* REGFI_ENCODING_ASCII
617	* REGFI_ENCODING_UTF8
618	*
619	* Returns:
620	* A newly allocated REGFI_ITERATOR. Must be free()d with regfi_iterator_free.
621	*/
622	REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* file,
623	REGFI_ENCODING output_encoding);
624
625
626	/* regfi_iterator_free: Frees a registry file iterator previously created by
627	* regfi_iterator_new.
628	*
629	* This does not affect the underlying registry file's allocation status.
630	*
631	* Arguments:
632	* file -- the iterator to be freed
633	*/
634	void regfi_iterator_free(REGFI_ITERATOR* i);
635
636
637	/* regfi_iterator_down: Traverse deeper into the registry tree at the
638	* current subkey.
639	*
640	* Arguments:
641	* i -- the iterator
642	*
643	* Returns:
644	* true on success, false on failure. Note that subkey and value indexes
645	* are preserved. That is, if a regfi_iterator_up call occurs later
646	* (reversing the effect of this call) then the subkey and value referenced
647	* prior to the regfi_iterator_down call will still be referenced. This
648	* makes depth-first iteration particularly easy.
649	*/
650	bool regfi_iterator_down(REGFI_ITERATOR* i);
651
652
653	/* regfi_iterator_up: Traverse up to the current key's parent key.
654	*
655	* Arguments:
656	* i -- the iterator
657	*
658	* Returns:
659	* true on success, false on failure. Any subkey or value state
660	* associated with the current key is lost.
661	*/
662	bool regfi_iterator_up(REGFI_ITERATOR* i);
663
664
665	/* regfi_iterator_to_root: Traverse up to the root key of the hive.
666	*
667	* Arguments:
668	* i -- the iterator
669	*
670	* Returns:
671	* true on success, false on failure.
672	*/
673	bool regfi_iterator_to_root(REGFI_ITERATOR* i);
674
675
676	/* regfi_iterator_walk_path: Traverse down multiple levels in the registry hive.
677	*
678	* Arguments:
679	* i -- the iterator
680	* path -- a list of key names representing the path. This list must
681	* contain NUL terminated strings. The list itself is
682	* terminated with a NULL pointer. All path elements must be
683	* keys; value names are not accepted (even as the last
684	* element).
685	*
686	* XXX: This currently only accepts ASCII key names. Need to look into
687	* accepting other encodings.
688	*
689	* Returns:
690	* true on success, false on failure. If any element of path is not found,
691	* false will be returned and the iterator will remain in its original
692	* position.
693	*/
694	bool regfi_iterator_walk_path(REGFI_ITERATOR* i,
695	const char** path);
696
697
698	/* regfi_iterator_cur_key: Returns the currently referenced key.
699	*
700	* Arguments:
701	* i -- the iterator
702	*
703	* Returns:
704	* A read-only key structure for the current key, or NULL on failure.
705	*/
706	const REGFI_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
707
708
709	/* regfi_iterator_cur_sk: Returns the SK (security) record referenced by the
710	* current key.
711	*
712	* Arguments:
713	* i -- the iterator
714	*
715	* Returns:
716	* A read-only SK structure, or NULL on failure.
717	*/
718	const REGFI_SK_REC* regfi_iterator_cur_sk(REGFI_ITERATOR* i);
719
720
721	/* regfi_iterator_first_subkey: Sets the internal subkey index to the first
722	* subkey referenced by the current key.
723	*
724	* Arguments:
725	* i -- the iterator
726	*
727	* Returns:
728	* A read-only key structure for the newly referenced first subkey,
729	* or NULL on failure. Failure may be due to a lack of any subkeys or other
730	* errors.
731	*/
732	REGFI_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i);
733
734
735	/* regfi_iterator_cur_subkey: Returns the currently indexed subkey.
736	*
737	* Arguments:
738	* i -- the iterator
739	*
740	* Returns:
741	* A newly allocated key structure for the currently referenced subkey,
742	* or NULL on failure. Newly allocated keys must be freed with
743	* regfi_free_key.
744	*/
745	REGFI_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
746	REGFI_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i);
747	bool regfi_iterator_find_subkey(REGFI_ITERATOR* i,
748	const char* subkey_name);
749
750	REGFI_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i);
751	REGFI_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i);
752	REGFI_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i);
753	bool regfi_iterator_find_value(REGFI_ITERATOR* i,
754	const char* value_name);
755
756	REGFI_CLASSNAME* regfi_iterator_fetch_classname(REGFI_ITERATOR* i,
757	const REGFI_NK_REC* key);
758	REGFI_DATA* regfi_iterator_fetch_data(REGFI_ITERATOR* i,
759	const REGFI_VK_REC* value);
760
761
762	/********************************************************/
763	/* Middle-layer structure loading, linking, and caching */
764	/********************************************************/
765	REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32 offset,
766	REGFI_ENCODING output_encoding,
767	bool strict);
768	REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32 offset,
769	REGFI_ENCODING output_encoding,
770	bool strict);
771	REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
772	uint32 num_keys, uint32 max_size,
773	bool strict);
774	REGFI_VALUE_LIST* regfi_load_valuelist(REGFI_FILE* file, uint32 offset,
775	uint32 num_values, uint32 max_size,
776	bool strict);
777
778	REGFI_BUFFER regfi_load_data(REGFI_FILE* file, uint32 voffset,
779	uint32 length, bool data_in_offset,
780	bool strict);
781
782	REGFI_BUFFER regfi_load_big_data(REGFI_FILE* file, uint32 offset,
783	uint32 data_length,uint32 cell_length,
784	range_list* used_ranges,
785	bool strict);
786	bool regfi_interpret_data(REGFI_FILE* file,
787	REGFI_ENCODING string_encoding,
788	uint32 type, REGFI_DATA* data);
789	void regfi_free_classname(REGFI_CLASSNAME* classname);
790	void regfi_free_data(REGFI_DATA* data);
791
792
793	/* These are cached so return values don't need to be freed. */
794	const REGFI_SK_REC* regfi_load_sk(REGFI_FILE* file, uint32 offset,
795	bool strict);
796	const REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
797
798
799	/************************************/
800	/* Low-layer data structure access */
801	/************************************/
802	REGFI_FILE* regfi_parse_regf(int fd, bool strict);
803	REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32 offset,
804	bool strict);
805
806
807	/* regfi_parse_nk: Parses an NK record.
808	*
809	* Arguments:
810	* f -- the registry file structure
811	* offset -- the offset of the cell (not the record) to be parsed.
812	* max_size -- the maximum size the NK cell could be. (for validation)
813	* strict -- if true, rejects any malformed records. Otherwise,
814	* tries to minimally validate integrity.
815	* Returns:
816	* A newly allocated NK record structure, or NULL on failure.
817	*/
818	REGFI_NK_REC* regfi_parse_nk(REGFI_FILE* file, uint32 offset,
819	uint32 max_size, bool strict);
820
821	REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
822	uint32 max_size, bool strict);
823
824	REGFI_VK_REC* regfi_parse_vk(REGFI_FILE* file, uint32 offset,
825	uint32 max_size, bool strict);
826
827	REGFI_SK_REC* regfi_parse_sk(REGFI_FILE* file, uint32 offset,
828	uint32 max_size, bool strict);
829
830	range_list* regfi_parse_unalloc_cells(REGFI_FILE* file);
831
832	bool regfi_parse_cell(int fd, uint32 offset,
833	uint8* hdr, uint32 hdr_len,
834	uint32* cell_length, bool* unalloc);
835
836	uint8* regfi_parse_classname(REGFI_FILE* file, uint32 offset,
837	uint16* name_length,
838	uint32 max_size, bool strict);
839
840	REGFI_BUFFER regfi_parse_data(REGFI_FILE* file, uint32 offset,
841	uint32 length, bool strict);
842
843	REGFI_BUFFER regfi_parse_little_data(REGFI_FILE* file, uint32 voffset,
844	uint32 length, bool strict);
845
846
847	/* Dispose of previously parsed records */
848	void regfi_free_key(REGFI_NK_REC* nk);
849	void regfi_free_value(REGFI_VK_REC* vk);
850
851
852
853	/************************************/
854	/* Private Functions */
855	/************************************/
856	REGFI_NK_REC* regfi_rootkey(REGFI_FILE* file,
857	REGFI_ENCODING output_encoding);
858	void regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
859	uint32 regfi_read(int fd, uint8* buf, uint32* length);
860
861	const char* regfi_type_val2str(unsigned int val);
862	int regfi_type_str2val(const char* str);
863
864	char* regfi_get_sacl(WINSEC_DESC* sec_desc);
865	char* regfi_get_dacl(WINSEC_DESC* sec_desc);
866	char* regfi_get_owner(WINSEC_DESC* sec_desc);
867	char* regfi_get_group(WINSEC_DESC* sec_desc);
868
869	REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16 num_lists,
870	REGFI_SUBKEY_LIST** lists,
871	bool strict);
872	REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
873	uint32 max_size, bool strict,
874	uint8 depth_left);
875	void regfi_add_message(REGFI_FILE* file, uint16 msg_type,
876	const char* fmt, ...);
877	REGFI_NK_REC* regfi_copy_nk(const REGFI_NK_REC* nk);
878	REGFI_VK_REC* regfi_copy_vk(const REGFI_VK_REC* vk);
879	int32 regfi_calc_maxsize(REGFI_FILE* file, uint32 offset);
880	int32 regfi_conv_charset(const char* input_charset,
881	const char* output_charset,
882	uint8* input, char* output,
883	uint32 input_len, uint32 output_max);
884	REGFI_DATA* regfi_buffer_to_data(REGFI_BUFFER raw_data);
885
886	#endif /* _REGFI_H */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: