source: trunk/include/regfi.h @ 178

Last change on this file since 178 was 178, checked in by tim, 14 years ago

reworked I/O to use callback functions

fixed a bug in mtime validation and consolidated time formatting code

  • Property svn:keywords set to Id
File size: 41.7 KB
Line 
1/*
2 * Copyright (C) 2005-2010 Timothy D. Morgan
3 * Copyright (C) 2005 Gerald (Jerry) Carter
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; version 3 of the License.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17 *
18 * $Id: regfi.h 178 2010-03-13 17:56:36Z tim $
19 */
20
21/**
22 * @file
23 * Windows NT (and later) read-only registry library
24 *
25 * This library is intended for use in digital forensics investigations, but
26 * is likely useful in other applications.
27 *
28 * Branched from Samba project Subversion repository, version #6903:
29 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
30 *
31 * Since then, it has been heavily rewritten, simplified, and improved.
32 */
33
34/**
35 * @mainpage Home
36 *
37 * The regfi library is a read-only NT registry library which serves as the main
38 * engine behind the reglookup tool.  It is designed with digital forensic
39 * analysis in mind, but it should also be useful in other tools which need to
40 * efficiently traverse and query registry data structures.
41 *
42 * The library is broken down into four main parts, the
43 * @ref regfiBase "Base Layer", which any code dependent on the library will
44 * likely need to rely on, as well as three main functional layers:
45 * @li @ref regfiIteratorLayer
46 * @li @ref regfiGlueLayer
47 * @li @ref regfiParseLayer
48 *
49 * Most users will find that a combination of the Base Layer and the Iterator Layer
50 * will be sufficient for accessing registry hive files.  Those who are wiling
51 * to dive deep into registry data structures, for instance to recover deleted
52 * data structures or to research Windows registry behavior in detail, will
53 * find the Parse Layer to be quite useful.
54 */
55
56
57#ifndef _REGFI_H
58#define _REGFI_H
59
60#include <stdlib.h>
61#include <stdio.h>
62#include <stdbool.h>
63#include <string.h>
64#include <errno.h>
65#include <time.h>
66#include <fcntl.h>
67#include <sys/stat.h>
68#include <sys/types.h>
69#include <unistd.h>
70#include <iconv.h>
71
72#include "byteorder.h"
73#include "talloc.h"
74#include "winsec.h"
75#include "void_stack.h"
76#include "range_list.h"
77#include "lru_cache.h"
78
79/******************************************************************************/
80
81/* regfi library error message types */
82#define REGFI_MSG_INFO  0x0001
83#define REGFI_MSG_WARN  0x0004
84#define REGFI_MSG_ERROR 0x0010
85
86typedef uint8_t REGFI_ENCODING;
87/* regfi library supported character encodings */
88#define REGFI_ENCODING_ASCII   0
89#define REGFI_ENCODING_UTF8    1
90#define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII
91/* UTF16LE is not supported for output */
92#define REGFI_ENCODING_UTF16LE 2
93
94#define REGFI_NUM_ENCODINGS    3
95
96/* Registry data types */
97#define REG_NONE                       0
98#define REG_SZ                         1
99#define REG_EXPAND_SZ                  2
100#define REG_BINARY                     3
101#define REG_DWORD                      4
102#define REG_DWORD_LE                   4  /* DWORD, little endian */
103#define REG_DWORD_BE                   5  /* DWORD, big endian */
104#define REG_LINK                       6
105#define REG_MULTI_SZ                   7
106#define REG_RESOURCE_LIST              8
107#define REG_FULL_RESOURCE_DESCRIPTOR   9
108#define REG_RESOURCE_REQUIREMENTS_LIST 10
109#define REG_QWORD                      11 /* 64-bit little endian */
110/* XXX: Has MS defined a REG_QWORD_BE? */
111/* Not a real type in the registry */
112#define REG_KEY                    0x7FFFFFFF
113
114#define REGFI_OFFSET_NONE          0xffffffff
115
116
117/* This maximum depth is described here:
118 * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
119 */
120#define REGFI_MAX_DEPTH            512
121
122/* This limit defines the maximum number of levels deep that ri subkey list
123 * trees can go.
124 */
125/* XXX: This is totally arbitrary right now.
126 *      The actual limit may need to be discovered by experimentation.
127 */
128#define REGFI_MAX_SUBKEY_DEPTH     255
129
130
131/* Header sizes and magic number lengths for various records */
132#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
133#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
134#define REGFI_REGF_MAGIC_SIZE      4
135#define REGFI_REGF_NAME_SIZE       64
136#define REGFI_REGF_RESERVED1_SIZE  340
137#define REGFI_REGF_RESERVED2_SIZE  3528
138#define REGFI_HBIN_MAGIC_SIZE      4
139#define REGFI_CELL_MAGIC_SIZE      2
140#define REGFI_HBIN_HEADER_SIZE     0x20
141#define REGFI_NK_MIN_LENGTH        0x4C
142#define REGFI_VK_MIN_LENGTH        0x14
143#define REGFI_SK_MIN_LENGTH        0x14
144#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
145#define REGFI_BIG_DATA_MIN_LENGTH  0xC
146
147
148/* Constants used for validation */
149/* XXX: Can we add clock resolution validation as well as range?  It has
150 *      been reported that Windows timestamps are never more than a
151 *      certain granularity (250ms?), which could be used to help
152 *      eliminate false positives.  Would need to verify this and
153 *      perhaps conservatively implement a check.
154 */
155 /* Minimum time is Jan 1, 1990 00:00:00 */
156#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
157
158 /* Maximum time is Jan 1, 2290 00:00:00
159  * (We hope no one is using Windows by then...)
160  */
161#define REGFI_MTIME_MAX_HIGH       0x03047543
162
163
164/* Flags for the vk records */
165#define REGFI_VK_FLAG_ASCIINAME    0x0001
166#define REGFI_VK_DATA_IN_OFFSET    0x80000000
167#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
168
169
170/* Known key flags */
171/*******************/
172/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
173#define REGFI_NK_FLAG_UNKNOWN1     0x4000
174#define REGFI_NK_FLAG_UNKNOWN2     0x1000
175
176/* This next one shows up in some Vista "software" registries */
177/* XXX: This shows up in the following two SOFTWARE keys in Vista:
178 *   /Wow6432Node/Microsoft
179 *   /Wow6432Node/Microsoft/Cryptography
180 * 
181 * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0
182 */
183#define REGFI_NK_FLAG_UNKNOWN3     0x0080
184
185/* Predefined handle.  Rumor has it that the valuelist count for this key is
186 * where the handle is stored.
187 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
188 */
189#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
190
191/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
192#define REGFI_NK_FLAG_ASCIINAME    0x0020
193
194/* Symlink key. 
195 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
196 */
197#define REGFI_NK_FLAG_LINK         0x0010
198
199/* This key cannot be deleted */
200#define REGFI_NK_FLAG_NO_RM        0x0008
201
202/* Root of a hive */
203#define REGFI_NK_FLAG_ROOT         0x0004
204
205/* Mount point of another hive.  NULL/(default) value indicates which hive
206 * and where in the hive it points to.
207 */
208#define REGFI_NK_FLAG_HIVE_LINK    0x0002
209
210/* These keys shouldn't be stored on disk, according to:
211 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
212 */
213#define REGFI_NK_FLAG_VOLATILE     0x0001
214
215/* Useful for identifying unknown flag types */
216#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
217                                    | REGFI_NK_FLAG_ASCIINAME\
218                                    | REGFI_NK_FLAG_LINK\
219                                    | REGFI_NK_FLAG_NO_RM\
220                                    | REGFI_NK_FLAG_ROOT\
221                                    | REGFI_NK_FLAG_HIVE_LINK\
222                                    | REGFI_NK_FLAG_VOLATILE\
223                                    | REGFI_NK_FLAG_UNKNOWN1\
224                                    | REGFI_NK_FLAG_UNKNOWN2\
225                                    | REGFI_NK_FLAG_UNKNOWN3)
226
227
228#define CHAR_BIT 8
229#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
230                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
231#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
232#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
233
234typedef struct _regfi_nttime
235{
236  uint32_t low;
237  uint32_t high;
238} REGFI_NTTIME;
239
240
241/** HBIN block information
242 * @ingroup regfiMiddleLayer
243 */
244typedef struct _regfi_hbin
245{
246  /** Offset of this HBIN in the registry file */
247  uint32_t file_off;
248
249  /** Number of active records pointing to this block (not used currently) */
250  uint32_t ref_count;
251
252  /** Offset from first hbin block */
253  uint32_t first_hbin_off;
254
255  /** Block size of this block Should be a multiple of 4096 (0x1000) */
256  uint32_t block_size;
257
258  /** Relative offset to next block. 
259   *
260   * @note This value may be unreliable!
261   */
262  uint32_t next_block;
263
264  /** Magic number for the HBIN (should be "hbin"). */
265  uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
266} REGFI_HBIN;
267
268
269/* Subkey List -- list of key offsets and hashed names for consistency */
270typedef struct 
271{
272  /* Virtual offset of NK record or additional subkey list,
273   * depending on this list's type.
274   */
275  uint32_t offset;
276
277  uint32_t hash;
278} REGFI_SUBKEY_LIST_ELEM;
279
280
281/** Subkey-list structure
282 * @ingroup regfiMiddleLayer
283 */
284typedef struct _regfi_subkey_list
285{
286  /* Real offset of this record's cell in the file */
287  uint32_t offset;
288
289  uint32_t cell_size;
290 
291  /* Number of immediate children */
292  uint32_t num_children; 
293
294  /* Total number of keys referenced by this list and it's children */
295  uint32_t num_keys;     
296
297  REGFI_SUBKEY_LIST_ELEM* elements;
298  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
299
300  /* Set if the magic indicates this subkey list points to child subkey lists */
301  bool recursive_type; 
302} REGFI_SUBKEY_LIST;
303
304
305typedef uint32_t REGFI_VALUE_LIST_ELEM;
306/** Value-list structure
307 * @ingroup regfiMiddleLayer
308 */
309typedef struct _regfi_value_list
310{
311  /* Actual number of values referenced by this list. 
312   * May differ from parent key's num_values if there were parsing errors.
313   */
314  uint32_t num_values;
315
316  REGFI_VALUE_LIST_ELEM* elements;
317} REGFI_VALUE_LIST;
318
319
320/** Class name structure (used in storing SysKeys)
321 * @ingroup regfiBase
322 */
323typedef struct _regfi_classname
324{
325  /** As converted to requested REGFI_ENCODING */
326  char* interpreted;
327
328  /** Represents raw buffer read from classname cell.
329   *
330   * Length of this item is specified in the size field.
331   */
332  uint8_t* raw;
333
334  /** Length of the raw data.
335   *
336   * May be shorter than that indicated by parent key.
337   */
338  uint16_t size;
339} REGFI_CLASSNAME;
340
341
342/** Data record structure
343 * @ingroup regfiBase
344 */
345typedef struct _regfi_data
346{
347  /** Data type of this data, as indicated by the referencing VK record. */
348  uint32_t type;
349
350  /** Length of the raw data. */
351  uint32_t size;
352
353  /** This is always present, representing the raw data cell contents. */
354  uint8_t* raw;
355
356  /** Represents the length of the interpreted value. Meaning is type-specific. */
357  uint32_t interpreted_size;
358
359  /** These items represent interpreted versions of the REGFI_DATA::raw field.
360   *
361   * Only use the appropriate member according to the REGFI_DATA::type field.
362   * In the event of an unknown type, use only the REGFI_DATA::raw field.
363   */
364  union _regfi_data_interpreted
365  {
366    /** REG_NONE
367     *
368     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
369     * length.
370     */
371    uint8_t* none; 
372
373    /** REG_SZ
374     *
375     * Stored as a NUL terminated string.  Converted to the specified
376     * REGFI_ENCODING.
377     */
378    uint8_t* string;
379
380    /** REG_EXPAND_SZ
381     *
382     * Stored as a NUL terminated string.  Converted to the specified
383     * REGFI_ENCODING.
384     */
385    uint8_t* expand_string;
386
387    /** REG_BINARY
388     *
389     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
390     * length.
391     */
392    uint8_t* binary;
393
394    /** REG_DWORD */
395    uint32_t dword;
396
397    /** REG_DWORD_BE */
398    uint32_t dword_be;
399
400    /** REG_LINK
401     *
402     * Stored as a NUL terminated string.  Converted to the specified
403     * REGFI_ENCODING.
404     */
405    uint8_t* link;
406
407    /** REG_MULTI_SZ
408     *
409     * Stored as a list of uint8_t* pointers, terminated with a NULL pointer.
410     * Each string element in the list is NUL terminated, and the character set
411     * is determined by the specified REGFI_ENCODING.
412     */
413    uint8_t** multiple_string;
414
415    /** REG_QWORD */
416    uint64_t qword;
417
418    /* The following are treated as binary currently, but this may change in
419     * the future as the formats become better understood.
420     */
421
422    /** REG_RESOURCE_LIST
423     *
424     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
425     * length.
426     */
427    uint8_t* resource_list;
428
429    /** REG_FULL_RESOURCE_DESCRIPTOR
430     *
431     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
432     * length.
433     */
434    uint8_t* full_resource_descriptor;
435
436    /** REG_RESOURCE_REQUIREMENTS_LIST
437     *
438     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
439     * length.
440     */
441    uint8_t* resource_requirements_list;
442  } interpreted;
443} REGFI_DATA;
444
445
446/** Value structure
447 * @ingroup regfiBase
448 */
449typedef struct
450{
451  /** Real offset of this record's cell in the file */
452  uint32_t offset;     
453
454  /** ((start_offset - end_offset) & 0xfffffff8) */
455  uint32_t cell_size;
456
457  /* XXX: deprecated */
458  REGFI_DATA* data;
459
460  /** The name of this value converted to desired REGFI_ENCODING. 
461   *
462   * This conversion typically occurs automatically through REGFI_ITERATOR
463   * settings.  String is NUL terminated.
464   */
465  char*    valuename;
466
467  /** The raw value name
468   *
469   * Length of the buffer is stored in name_length.
470   */
471  uint8_t* valuename_raw;
472
473  /** Length of valuename_raw */
474  uint16_t name_length;
475
476  /** Offset from beginning of this hbin block */
477  uint32_t hbin_off;
478 
479  /** Size of the value's data as reported in the VK record.
480   *
481   * May be different than that obtained while parsing the data cell itself.
482   */
483  uint32_t data_size;
484
485  /** Virtual offset of data cell */
486  uint32_t data_off;
487
488  /** Value's data type */
489  uint32_t type;
490
491  /** VK record's magic number (should be "vk") */
492  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
493
494  /** VK record flags */
495  uint16_t flags;
496
497  /* XXX: A 2-byte field of unknown purpose stored in the VK record */
498  uint16_t unknown1;
499
500  /** Whether or not the data record is stored in the VK record's data_off field.
501   *
502   * This information is derived from the high bit of the raw data size field.
503   */
504  bool     data_in_offset;
505} REGFI_VK_REC;
506
507
508/* Key Security */
509struct _regfi_sk_rec;
510
511/** Security structure
512 * @ingroup regfiBase
513 */
514typedef struct _regfi_sk_rec
515{
516  /** Real file offset of this record */
517  uint32_t offset;
518
519  /** ((start_offset - end_offset) & 0xfffffff8) */
520  uint32_t cell_size;
521
522  /** The stored Windows security descriptor for this SK record */
523  WINSEC_DESC* sec_desc;
524
525  /** Offset of this record from beginning of this hbin block */
526  uint32_t hbin_off;
527 
528  /** Offset of the previous SK record in the linked list of SK records */
529  uint32_t prev_sk_off;
530
531  /** Offset of the next SK record in the linked list of SK records */
532  uint32_t next_sk_off;
533
534  /** Number of keys referencing this SK record */
535  uint32_t ref_count;
536
537  /** Size of security descriptor (sec_desc) */
538  uint32_t desc_size;
539
540  /* XXX: A 2-byte field of unknown purpose */
541  uint16_t unknown_tag;
542
543  /** The magic number for this record (should be "sk") */
544  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
545} REGFI_SK_REC;
546
547
548/** Key structure
549 * @ingroup regfiBase
550 */
551typedef struct
552{
553  /** Real offset of this record's cell in the file */
554  uint32_t offset;
555
556  /** Actual or estimated length of the cell. 
557   * Always in multiples of 8.
558   */
559  uint32_t cell_size;
560
561  /** Preloaded value-list for this key.
562   * This element is loaded automatically when using the iterator interface and
563   * possibly some lower layer interfaces.
564   */
565  REGFI_VALUE_LIST* values;
566
567
568  /** Preloaded subkey-list for this key.
569   * This element is loaded automatically when using the iterator interface and
570   * possibly some lower layer interfaces.
571   */
572  REGFI_SUBKEY_LIST* subkeys;
573 
574  /** Key flags */
575  uint16_t flags;
576
577  /** Magic number of key (should be "nk") */
578  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
579
580  /** Key's last modification time */
581  REGFI_NTTIME mtime;
582
583  /** Length of keyname_raw */
584  uint16_t name_length;
585
586  /** Length of referenced classname */
587  uint16_t classname_length;
588
589  /** The name of this key converted to desired REGFI_ENCODING. 
590   *
591   * This conversion typically occurs automatically through REGFI_ITERATOR
592   * settings.  String is NUL terminated.
593   */
594  char* keyname;
595
596  /** The raw key name
597   *
598   * Length of the buffer is stored in name_length.
599   */
600  uint8_t* keyname_raw;
601
602  /** Virutal offset of parent key */
603  uint32_t parent_off;
604
605  /** Virutal offset of classname key */
606  uint32_t classname_off;
607 
608  /* XXX: max subkey name * 2 */
609  uint32_t max_bytes_subkeyname;
610
611  /* XXX: max subkey classname length (as if) */
612  uint32_t max_bytes_subkeyclassname;
613
614  /* XXX: max valuename * 2 */
615  uint32_t max_bytes_valuename;
616
617  /* XXX: max value data size */
618  uint32_t max_bytes_value;
619 
620  /* XXX: Fields of unknown purpose */
621  uint32_t unknown1;
622  uint32_t unknown2;
623  uint32_t unknown3;
624  uint32_t unk_index;               /* nigel says run time index ? */
625 
626  /** Number of subkeys */
627  uint32_t num_subkeys;
628
629  /** Virtual offset of subkey-list */
630  uint32_t subkeys_off;
631
632  /** Number of values for this key */
633  uint32_t num_values;
634
635  /** Virtual offset of value-list */
636  uint32_t values_off;
637
638  /** Virtual offset of SK record */
639  uint32_t sk_off;
640} REGFI_NK_REC;
641
642
643typedef struct _regfi_raw_file
644{
645  off_t    (* seek)(); /* (REGFI_RAW_FILE* self, off_t offset, int whence) */
646  ssize_t  (* read)(); /* (REGFI_RAW_FILE* self, void* buf, size_t count) */
647
648  uint64_t cur_off;
649  uint64_t size;
650  void*    state;
651} REGFI_RAW_FILE;
652
653
654/** Registry hive file data structure
655 *
656 * This essential structure stores run-time information about a single open
657 * registry hive as well as file header (REGF block) data.  This structure
658 * also stores a list of warnings and error messages generated while parsing
659 * the registry hive.  These can be tuned using @ref regfi_set_message_mask. 
660 * Messages may be retrieved using @ref regfi_get_messages.
661 *
662 * @note If the message mask is set to record any messages, dependent code
663 *       must use @ref regfi_get_messages periodically to clear the message
664 *       queue. Otherwise, this structure will grow in size over time as
665 *       messages queue up.
666 *
667 * @ingroup regfiBase
668 */ 
669typedef struct _regfi_file
670{
671  /* Run-time information */
672  /************************/
673  /* Functions for accessing the file */
674  REGFI_RAW_FILE* cb;
675
676  /* For sanity checking (not part of the registry header) */
677  uint32_t file_length;
678
679  /* Metadata about hbins */
680  range_list* hbins;
681
682  /* SK record cached since they're repeatedly reused */
683  lru_cache* sk_cache;
684
685  /* Error/warning/info messages returned by lower layer functions */
686  char* last_message;
687
688  /* Mask for error message types that will be stored. */
689  uint16_t msg_mask;
690
691
692  /* Data parsed from file header */
693  /********************************/
694  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
695
696 /* These sequence numbers should match if
697  * the hive was properly synced to disk.
698  */
699  uint32_t sequence1;           
700  uint32_t sequence2;
701
702  REGFI_NTTIME mtime;
703  uint32_t major_version;  /* Set to 1 in all known hives */
704  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
705  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
706  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
707
708  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
709  uint32_t last_block; /* Offset to last hbin block in file */
710
711  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
712
713  /* Matches hive's base file name. Stored in UTF-16LE */
714  uint8_t file_name[REGFI_REGF_NAME_SIZE];
715
716  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
717  WINSEC_UUID* log_id;      /* XXX: Unverified. */
718  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
719  uint32_t flags;             /* XXX: Unverified. */
720  uint32_t guid_signature;    /* XXX: Unverified. */
721
722  uint32_t checksum;          /* Stored checksum from file */
723  uint32_t computed_checksum; /* Our own calculation of the checksum.
724                             * (XOR of bytes 0x0000 - 0x01FB) */
725
726  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
727  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
728  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
729  uint32_t boot_type;         /* XXX: Unverified. */
730  uint32_t boot_recover;      /* XXX: Unverified. */
731
732  /* This seems to include random junk.  Possibly unsanitized memory left over
733   * from when header block was written.  For instance, chunks of nk records
734   * can be found, though often it's all 0s. */
735  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
736
737  /* This is likely reserved and unusued currently.  (Should be all 0s.)
738   * Included here for easier access in looking for hidden data
739   * or doing research. */
740  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
741
742} REGFI_FILE;
743
744
745/** Registry hive iterator
746 * @ingroup regfiIteratorLayer
747 */
748typedef struct _regfi_iterator
749{
750  /** The registry hive this iterator is associated with */
751  REGFI_FILE* f;
752
753  /** All current parent keys and associated iterator positions */
754  void_stack* key_positions;
755
756  /** The current key */
757  REGFI_NK_REC* cur_key;
758
759  /** The encoding that all strings are converted to as set during iterator
760   *  creation.
761   */
762  REGFI_ENCODING string_encoding;
763
764  /** Index of the current subkey */
765  uint32_t cur_subkey;
766
767  /** Index of the current value */
768  uint32_t cur_value;
769} REGFI_ITERATOR;
770
771
772typedef struct _regfi_iter_position
773{
774  REGFI_NK_REC* nk;
775  uint32_t cur_subkey;
776  /* We could store a cur_value here as well, but didn't see
777   * the use in it right now.
778   */
779} REGFI_ITER_POSITION;
780
781
782/** General purpose buffer with stored length
783 * @ingroup regfiBottomLayer
784 */
785typedef struct _regfi_buffer
786{
787  uint8_t* buf;
788  uint32_t len;
789} REGFI_BUFFER;
790
791
792
793/******************************************************************************/
794/**
795 * @defgroup regfiBase Base Layer: Essential Functions and Data Structures
796 *
797 * These functions are either necessary for normal use of the regfi API or just
798 * don't fit particularly well in any of the other layers.
799 */
800/******************************************************************************/
801
802/** Parses file headers of an already open registry hive file and
803 *  allocates related structures for further parsing.
804 *
805 * @param fd A file descriptor of an already open file.  Must be seekable.
806 *
807 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
808 *         NULL on error.
809 *
810 * @ingroup regfiBase
811 */
812REGFI_FILE*           regfi_alloc(int fd);
813
814
815/** Parses file headers returned by supplied callback functions.
816 *
817 * This interface is useful if you have a registry hive in memory
818 * or have some other reason to emulate a real file.
819 *
820 * @param file_cb A structure defining the callback functions needed to access the file.
821 *
822 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
823 *         NULL on error.
824 *
825 * @ingroup regfiBase
826 */
827REGFI_FILE*           regfi_alloc_cb(REGFI_RAW_FILE* file_cb);
828
829
830/** Frees a hive's data structures without closing the underlying file.
831 *
832 * @param file The registry structure to free.
833 *
834 * @ingroup regfiBase
835 */
836void                  regfi_free(REGFI_FILE* file);
837
838
839/** Get errors, warnings, and/or verbose information relating to processing of
840 *  the given registry file.
841 *
842 * @param file the structure for the registry file
843 *
844 * @return A newly allocated char* which must be free()d by the caller.
845 *
846 * @ingroup regfiBase
847 */
848char*                 regfi_get_messages(REGFI_FILE* file);
849
850
851/** Set the verbosity level of errors and warnings generated by the library
852 *  (as accessible via regfi_get_messages).
853 *
854 * This may be called at any time and will take effect immediately.
855 *
856 * @param file   the structure for the registry file
857 *
858 * @param mask   an integer representing the types of messages desired.
859 *               Acceptable values are created through bitwise ORs of
860 *               REGFI_MSG_* values.  For instance, if only errors and
861 *               informational messages were desired (but not warnings),
862 *               then one would specify: REGFI_MSG_ERROR|REGFI_MSG_INFO
863 *               New REGFI_FILE structures are created with:
864 *                REGFI_MSG_ERROR|REGFI_MSG_WARN
865 *               Note that error and warning messages will continue to
866 *               accumulate in memory if they are not fetched using
867 *               regfi_get_messages and then freed by the caller.
868 *               To disable error messages entirely, supply 0, which
869 *               will prevent message accumulation. 
870 *
871 * @ingroup regfiBase
872 */
873void                  regfi_set_message_mask(REGFI_FILE* file, uint16_t mask);
874
875
876/* Dispose of previously parsed records */
877
878/** Frees a key structure previously returned by one of the API functions
879 *
880 * XXX: finish documenting
881 *
882 * @ingroup regfiBase
883 */
884void                  regfi_free_key(REGFI_NK_REC* nk);
885
886
887/** Frees a value structure previously returned by one of the API functions
888 *
889 * XXX: finish documenting
890 *
891 * @ingroup regfiBase
892 */
893void                  regfi_free_value(REGFI_VK_REC* vk);
894
895
896
897/******************************************************************************/
898/**
899 * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface
900 *
901 * This top layer of API functions provides an iterator interface which makes
902 * traversing registry data structures easy in both single-threaded and
903 * multi-threaded scenarios.
904 */
905/******************************************************************************/
906
907/** Creates a new iterator for the provided registry file.
908 *
909 * @param file The opened registry file the iterator should be created for.
910 *
911 * @param output_encoding Character encoding that strings should be returned in.
912 *                        Only supply the REGFI_ENCODING_* constants, as others
913 *                        will be rejected.
914 *                        The following values are currently accepted:
915 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
916 *                        REGFI_ENCODING_ASCII
917 *                        REGFI_ENCODING_UTF8
918 *
919 * @return A newly allocated REGFI_ITERATOR.
920 *         Must be free()d with regfi_iterator_free.
921 *
922 * @ingroup regfiIteratorLayer
923 */
924REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* file,
925                                         REGFI_ENCODING output_encoding);
926
927
928/** Frees a registry file iterator previously created by regfi_iterator_new.
929 *
930 * This does not affect the underlying registry file's allocation status.
931 *
932 * @param i the iterator to be freed
933 *
934 * @ingroup regfiIteratorLayer
935 */
936void                  regfi_iterator_free(REGFI_ITERATOR* i);
937
938
939/** Traverse deeper into the registry tree at the current subkey.
940 *
941 * @param i the iterator
942 *
943 * @return  true on success, false on failure. 
944 *          Note that subkey and value indexes are preserved.  That is, if a
945 *          regfi_iterator_up call occurs later (reversing the effect of this
946 *          call) then the subkey and value referenced prior to the
947 *          regfi_iterator_down call will still be referenced.  This  makes
948 *          depth-first iteration particularly easy.
949 *
950 * @ingroup regfiIteratorLayer
951 */
952bool                  regfi_iterator_down(REGFI_ITERATOR* i);
953
954
955/** Traverse up to the current key's parent key.
956 *
957 * @param i the iterator
958 *
959 * @return  true on success, false on failure.  Any subkey or value state
960 *          associated with the current key is lost.
961 *
962 * @ingroup regfiIteratorLayer
963 */
964bool                  regfi_iterator_up(REGFI_ITERATOR* i);
965
966
967/** Traverse up to the root key of the hive.
968 *
969 * @param i the iterator
970 *
971 * @return true on success, false on failure.
972 *
973 * @ingroup regfiIteratorLayer
974 */
975bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
976
977
978/** Traverse down multiple levels in the registry hive.
979 *
980 * XXX: This currently only accepts ASCII key names.  Need to look into
981 *      accepting other encodings.
982 *
983 * @param i    the iterator
984 * @param path a list of key names representing the path.  This list must
985 *             contain NUL terminated strings.  The list itself is
986 *             terminated with a NULL pointer.  All path elements must be
987 *             keys; value names are not accepted (even as the last
988 *             element).
989 *
990 * @return true on success, false on failure.  If any element of path is not
991 *                 found, false will be returned and the iterator will remain
992 *                 in its original position.
993 *
994 * @ingroup regfiIteratorLayer
995 */
996bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
997
998
999/** Returns the currently referenced key.
1000 *
1001 * @param i the iterator
1002 *
1003 * @return A read-only key structure for the current key, or NULL on failure.
1004 *
1005 * @ingroup regfiIteratorLayer
1006 */
1007const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
1008
1009
1010/** Returns the SK (security) record referenced by the current key.
1011 *
1012 * @param i the iterator
1013 *
1014 * @return A read-only SK structure, or NULL on failure.
1015 *
1016 * @ingroup regfiIteratorLayer
1017 */
1018const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
1019
1020
1021/** Sets the internal subkey index to the first subkey referenced by the current
1022 *  key and returns that key.
1023 *
1024 * @param i the iterator
1025 *
1026 * @return A newly allocated key structure for the newly referenced first
1027 *         subkey, or NULL on failure.  Failure may be due to a lack of any
1028 *         subkeys or other errors.  Newly allocated keys must be freed with
1029 *         regfi_free_key.
1030 *
1031 * @ingroup regfiIteratorLayer
1032 */
1033REGFI_NK_REC*         regfi_iterator_first_subkey(REGFI_ITERATOR* i);
1034
1035
1036/** Returns the currently indexed subkey.
1037 *
1038 * @param i the iterator
1039 *
1040 * @return A newly allocated key structure for the currently referenced subkey,
1041 *         or NULL on failure.  Newly allocated keys must be freed with
1042 *         regfi_free_key.
1043 *
1044 * @ingroup regfiIteratorLayer
1045 */
1046REGFI_NK_REC*         regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
1047
1048
1049/** Increments the internal subkey index to the next key in the subkey-list and
1050 *  returns the subkey for that index.
1051 *
1052 * @param i the iterator
1053 *
1054 * @return A newly allocated key structure for the next subkey or NULL on
1055 *         failure.  Newly allocated keys must be freed with regfi_free_key.
1056 *
1057 * @ingroup regfiIteratorLayer
1058 */
1059REGFI_NK_REC*         regfi_iterator_next_subkey(REGFI_ITERATOR* i);
1060
1061
1062/** Searches for a subkey with a given name under the current key.
1063 *
1064 * @param i           the iterator
1065 * @param subkey_name subkey name to search for
1066 *
1067 * @return True if such a subkey was found, false otherwise.  If a subkey is
1068 *         found, the current subkey index is set to that subkey.  Otherwise,
1069 *         the subkey index remains at the same location as before the call.
1070 *
1071 * @ingroup regfiIteratorLayer
1072 */
1073bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
1074                                                 const char* subkey_name);
1075
1076/** Sets the internal value index to the first value referenced by the current
1077 *  key and returns that value.
1078 *
1079 * @param i the iterator
1080 *
1081 * @return  A newly allocated value structure for the newly referenced first
1082 *          value, or NULL on failure.  Failure may be due to a lack of any
1083 *          values or other errors.  Newly allocated keys must be freed with
1084 *          regfi_free_value.
1085 *
1086 * @ingroup regfiIteratorLayer
1087 */
1088REGFI_VK_REC*         regfi_iterator_first_value(REGFI_ITERATOR* i);
1089
1090
1091/** Returns the currently indexed value.
1092 *
1093 * @param i the iterator
1094 *
1095 * @return A newly allocated value structure for the currently referenced value,
1096 *         or NULL on failure.  Newly allocated values must be freed with
1097 *         regfi_free_value.
1098 *
1099 * @ingroup regfiIteratorLayer
1100 */
1101REGFI_VK_REC*         regfi_iterator_cur_value(REGFI_ITERATOR* i);
1102
1103
1104/** Increments the internal value index to the next value in the value-list and
1105 *  returns the value for that index.
1106 *
1107 * @param i the iterator
1108 *
1109 * @return  A newly allocated key structure for the next value or NULL on
1110 *          failure.  Newly allocated keys must be freed with regfi_free_value.
1111 *
1112 * @ingroup regfiIteratorLayer
1113 */
1114REGFI_VK_REC*         regfi_iterator_next_value(REGFI_ITERATOR* i);
1115
1116
1117/** Searches for a value with a given name under the current key.
1118 *
1119 * @param i          the iterator
1120 * @param value_name value name to search for
1121 *
1122 * @return True if such a value was found, false otherwise.  If a value is
1123 *         found, the current value index is set to that value.  Otherwise,
1124 *         the value index remains at the same location as before the call.
1125 *
1126 * @ingroup regfiIteratorLayer
1127 */
1128bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
1129                                                const char* value_name);
1130
1131/** Retrieves classname for a given key.
1132 *
1133 * @param i   the iterator
1134 * @param key the key whose classname is desired
1135 *
1136 * @return Returns a newly allocated classname structure, or NULL on failure.
1137 *         Classname structures must be freed with regfi_free_classname.
1138 *
1139 * @ingroup regfiIteratorLayer
1140 */
1141REGFI_CLASSNAME*      regfi_iterator_fetch_classname(REGFI_ITERATOR* i, 
1142                                                     const REGFI_NK_REC* key);
1143
1144
1145/** Retrieves data for a given value.
1146 *
1147 * @param i     the iterator
1148 * @param value the value whose data is desired
1149 *
1150 * @return Returns a newly allocated data structure, or NULL on failure.
1151 *         Data structures must be freed with regfi_free_data.
1152 *
1153 * @ingroup regfiIteratorLayer
1154 */
1155REGFI_DATA*           regfi_iterator_fetch_data(REGFI_ITERATOR* i, 
1156                                                const REGFI_VK_REC* value);
1157
1158
1159
1160/******************************************************************************/
1161/**
1162 * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading
1163 */
1164/******************************************************************************/
1165
1166/** Loads a key at a given file offset along with associated data structures.
1167 *
1168 * XXX: finish documenting
1169 *
1170 * @ingroup regfiGlueLayer
1171 */
1172REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32_t offset, 
1173                                     REGFI_ENCODING output_encoding, 
1174                                     bool strict);
1175
1176
1177/** Loads a value at a given file offset alng with associated data structures.
1178 *
1179 * XXX: finish documenting
1180 *
1181 * @ingroup regfiGlueLayer
1182 */
1183REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32_t offset, 
1184                                       REGFI_ENCODING output_encoding, 
1185                                       bool strict);
1186
1187
1188/** Loads a logical subkey list in its entirety which may span multiple records.
1189 *
1190 * XXX: finish documenting
1191 *
1192 * @ingroup regfiGlueLayer
1193 */
1194REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
1195                                            uint32_t num_keys, uint32_t max_size,
1196                                            bool strict);
1197
1198
1199/** Loads a valuelist.
1200 *
1201 * XXX: finish documenting
1202 *
1203 * @ingroup regfiGlueLayer
1204 */
1205REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, 
1206                                           uint32_t num_values, uint32_t max_size,
1207                                           bool strict);
1208
1209
1210/** Loads a data record which may be contained in the virtual offset, in a
1211 *  single cell, or in multiple cells through big data records.
1212 *
1213 * XXX: finish documenting
1214 *
1215 * @ingroup regfiGlueLayer
1216 */
1217REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32_t voffset,
1218                                      uint32_t length, bool data_in_offset,
1219                                      bool strict);
1220
1221
1222/** Loads the data associated with a big data record at the specified offset.
1223 *
1224 * XXX: finish documenting
1225 *
1226 * @ingroup regfiGlueLayer
1227 */
1228REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32_t offset, 
1229                                          uint32_t data_length,uint32_t cell_length,
1230                                          range_list* used_ranges,
1231                                          bool strict);
1232
1233
1234/** Given raw data, attempts to interpret the data based on a specified registry
1235 *  data type.
1236 *
1237 * XXX: finish documenting
1238 *
1239 * @ingroup regfiGlueLayer
1240 */
1241bool                  regfi_interpret_data(REGFI_FILE* file, 
1242                                           REGFI_ENCODING string_encoding,
1243                                           uint32_t type, REGFI_DATA* data);
1244
1245
1246/** Frees the memory associated with a REGFI_CLASSNAME data structure.
1247 *
1248 * XXX: finish documenting
1249 *
1250 * @ingroup regfiGlueLayer
1251 */
1252void                  regfi_free_classname(REGFI_CLASSNAME* classname);
1253
1254
1255/** Frees the memory associated with a REGFI_DATA data structure.
1256 *
1257 * XXX: finish documenting
1258 *
1259 * @ingroup regfiGlueLayer
1260 */
1261void                  regfi_free_data(REGFI_DATA* data);
1262
1263
1264/* These are cached so return values don't need to be freed. */
1265
1266/** Loads an "sk" security record at the specified offset.
1267 *
1268 * XXX: finish documenting
1269 *
1270 * @ingroup regfiGlueLayer
1271 */
1272const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32_t offset,
1273                                    bool strict);
1274
1275
1276/** Retrieves the HBIN data structure stored at the specified offset.
1277 *
1278 * XXX: finish documenting
1279 *
1280 * @ingroup regfiGlueLayer
1281 */
1282const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
1283
1284
1285
1286/******************************************************************************/
1287/**
1288 * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access
1289 */
1290/******************************************************************************/
1291
1292REGFI_FILE*           regfi_parse_regf(REGFI_RAW_FILE* file_cb, bool strict);
1293REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, 
1294                                       bool strict);
1295
1296
1297/** Parses an NK record at the specified offset
1298 *
1299 * @param file     the registry file structure
1300 * @param offset   the offset of the cell (not the record) to be parsed.
1301 * @param max_size the maximum size the NK cell could be. (for validation)
1302 * @param strict   if true, rejects any malformed records.  Otherwise,
1303 *                 tries to minimally validate integrity.
1304 *
1305 * @return A newly allocated NK record structure, or NULL on failure.
1306 *
1307 * @ingroup regfiParseLayer
1308 */
1309REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
1310                                     uint32_t max_size, bool strict);
1311
1312
1313/** Parses a single cell containing a subkey-list record.
1314 *
1315 * XXX: finish documenting
1316 *
1317 * @ingroup regfiParseLayer
1318 */
1319REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
1320                                             uint32_t max_size, bool strict);
1321
1322
1323/** Parses a VK (value) record at the specified offset
1324 *
1325 * XXX: finish documenting
1326 *
1327 * @ingroup regfiParseLayer
1328 */
1329REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32_t offset, 
1330                                     uint32_t max_size, bool strict);
1331
1332
1333/** Parses an SK (security) record at the specified offset
1334 *
1335 * XXX: finish documenting
1336 *
1337 * @ingroup regfiParseLayer
1338 */
1339REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32_t offset, 
1340                                     uint32_t max_size, bool strict);
1341
1342
1343/** Retrieves information on all cells in the registry hive which are
1344 *  currently in the unallocated status. 
1345 *
1346 * The unallocated status is determined based soley on the cell length sign.
1347 *
1348 * XXX: finish documenting
1349 *
1350 * @ingroup regfiParseLayer
1351 */
1352range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
1353
1354
1355/** Helper function to parse a cell
1356 *
1357 * XXX: finish documenting
1358 *
1359 * @ingroup regfiParseLayer
1360 */
1361bool                  regfi_parse_cell(REGFI_RAW_FILE* file_cb, uint32_t offset,
1362                                       uint8_t* hdr, uint32_t hdr_len,
1363                                       uint32_t* cell_length, bool* unalloc);
1364
1365
1366/** Parses a classname cell
1367 *
1368 * XXX: finish documenting
1369 *
1370 * @ingroup regfiParseLayer
1371 */
1372uint8_t*                regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
1373                                            uint16_t* name_length, 
1374                                            uint32_t max_size, bool strict);
1375
1376
1377/** Parses a single-cell data record
1378 *
1379 * XXX: finish documenting
1380 *
1381 * @ingroup regfiParseLayer
1382 */
1383REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32_t offset,
1384                                       uint32_t length, bool strict);
1385
1386
1387/** Parses a "little data" record which is stored entirely within the
1388 *  provided virtual offset.
1389 *
1390 * XXX: finish documenting
1391 *
1392 * @ingroup regfiParseLayer
1393 */
1394REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, 
1395                                              uint32_t length, bool strict);
1396
1397
1398/******************************************************************************/
1399/*    Private Functions                                                       */
1400/******************************************************************************/
1401REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file, 
1402                                    REGFI_ENCODING output_encoding);
1403void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
1404
1405off_t                 regfi_raw_seek(REGFI_RAW_FILE* self, 
1406                                     off_t offset, int whence);
1407ssize_t               regfi_raw_read(REGFI_RAW_FILE* self, 
1408                                     void* buf, size_t count);
1409off_t                 regfi_seek(REGFI_RAW_FILE* file_cb, 
1410                                 off_t offset, int whence);
1411uint32_t              regfi_read(REGFI_RAW_FILE* file_cb, 
1412                                 uint8_t* buf, uint32_t* length);
1413
1414const char*           regfi_type_val2str(unsigned int val);
1415int                   regfi_type_str2val(const char* str);
1416
1417char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
1418char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
1419char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
1420char*                 regfi_get_group(WINSEC_DESC* sec_desc);
1421
1422REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists, 
1423                                              REGFI_SUBKEY_LIST** lists,
1424                                              bool strict);
1425REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1426                                                uint32_t max_size, bool strict,
1427                                                uint8_t depth_left);
1428void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type, 
1429                                        const char* fmt, ...);
1430REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
1431REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
1432int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1433int32_t               regfi_conv_charset(const char* input_charset, 
1434                                         const char* output_charset,
1435                                         uint8_t* input, char* output, 
1436                                         uint32_t input_len, uint32_t output_max);
1437REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
1438
1439/* XXX: move to base API and document */
1440void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
1441time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
1442
1443
1444void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk, 
1445                             REGFI_ENCODING output_encoding, bool strict);
1446void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk, 
1447                               REGFI_ENCODING output_encoding, bool strict);
1448
1449
1450#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.