source: trunk/include/regfi.h @ 180

Last change on this file since 180 was 180, checked in by tim, 14 years ago

Added locks to make transactions on REGFI_FILE objects thread safe

Added initial version of a threading smoke test

  • Property svn:keywords set to Id
File size: 42.1 KB
Line 
1/*
2 * Copyright (C) 2005-2010 Timothy D. Morgan
3 * Copyright (C) 2005 Gerald (Jerry) Carter
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; version 3 of the License.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17 *
18 * $Id: regfi.h 180 2010-03-14 20:02:38Z tim $
19 */
20
21/**
22 * @file
23 * Windows NT (and later) read-only registry library
24 *
25 * This library is intended for use in digital forensics investigations, but
26 * is likely useful in other applications.
27 *
28 * Branched from Samba project Subversion repository, version #6903:
29 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
30 *
31 * Since then, it has been heavily rewritten, simplified, and improved.
32 */
33
34/**
35 * @mainpage Home
36 *
37 * The regfi library is a read-only NT registry library which serves as the main
38 * engine behind the reglookup tool.  It is designed with digital forensic
39 * analysis in mind, but it should also be useful in other tools which need to
40 * efficiently traverse and query registry data structures.
41 *
42 * The library is broken down into four main parts, the
43 * @ref regfiBase "Base Layer", which any code dependent on the library will
44 * likely need to rely on, as well as three main functional layers:
45 * @li @ref regfiIteratorLayer
46 * @li @ref regfiGlueLayer
47 * @li @ref regfiParseLayer
48 *
49 * Most users will find that a combination of the Base Layer and the Iterator Layer
50 * will be sufficient for accessing registry hive files.  Those who are wiling
51 * to dive deep into registry data structures, for instance to recover deleted
52 * data structures or to research Windows registry behavior in detail, will
53 * find the Parse Layer to be quite useful.
54 */
55
56
57#ifndef _REGFI_H
58#define _REGFI_H
59
60#include <stdlib.h>
61#include <stdio.h>
62#include <stdbool.h>
63#include <string.h>
64#include <errno.h>
65#include <time.h>
66#include <fcntl.h>
67#include <sys/stat.h>
68#include <sys/types.h>
69#include <unistd.h>
70#include <iconv.h>
71#include <pthread.h>
72
73#include "byteorder.h"
74#include "talloc.h"
75#include "winsec.h"
76#include "void_stack.h"
77#include "range_list.h"
78#include "lru_cache.h"
79
80/******************************************************************************/
81
82/* regfi library error message types */
83#define REGFI_MSG_INFO  0x0001
84#define REGFI_MSG_WARN  0x0004
85#define REGFI_MSG_ERROR 0x0010
86
87typedef uint8_t REGFI_ENCODING;
88/* regfi library supported character encodings */
89#define REGFI_ENCODING_ASCII   0
90#define REGFI_ENCODING_UTF8    1
91#define REGFI_ENCODING_DEFAULT REGFI_ENCODING_ASCII
92/* UTF16LE is not supported for output */
93#define REGFI_ENCODING_UTF16LE 2
94
95#define REGFI_NUM_ENCODINGS    3
96
97/* Registry data types */
98#define REG_NONE                       0
99#define REG_SZ                         1
100#define REG_EXPAND_SZ                  2
101#define REG_BINARY                     3
102#define REG_DWORD                      4
103#define REG_DWORD_LE                   4  /* DWORD, little endian */
104#define REG_DWORD_BE                   5  /* DWORD, big endian */
105#define REG_LINK                       6
106#define REG_MULTI_SZ                   7
107#define REG_RESOURCE_LIST              8
108#define REG_FULL_RESOURCE_DESCRIPTOR   9
109#define REG_RESOURCE_REQUIREMENTS_LIST 10
110#define REG_QWORD                      11 /* 64-bit little endian */
111/* XXX: Has MS defined a REG_QWORD_BE? */
112/* Not a real type in the registry */
113#define REG_KEY                    0x7FFFFFFF
114
115#define REGFI_OFFSET_NONE          0xffffffff
116
117
118/* This maximum depth is described here:
119 * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
120 */
121#define REGFI_MAX_DEPTH            512
122
123/* This limit defines the maximum number of levels deep that ri subkey list
124 * trees can go.
125 */
126/* XXX: This is totally arbitrary right now.
127 *      The actual limit may need to be discovered by experimentation.
128 */
129#define REGFI_MAX_SUBKEY_DEPTH     255
130
131
132/* Header sizes and magic number lengths for various records */
133#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
134#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
135#define REGFI_REGF_MAGIC_SIZE      4
136#define REGFI_REGF_NAME_SIZE       64
137#define REGFI_REGF_RESERVED1_SIZE  340
138#define REGFI_REGF_RESERVED2_SIZE  3528
139#define REGFI_HBIN_MAGIC_SIZE      4
140#define REGFI_CELL_MAGIC_SIZE      2
141#define REGFI_HBIN_HEADER_SIZE     0x20
142#define REGFI_NK_MIN_LENGTH        0x4C
143#define REGFI_VK_MIN_LENGTH        0x14
144#define REGFI_SK_MIN_LENGTH        0x14
145#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
146#define REGFI_BIG_DATA_MIN_LENGTH  0xC
147
148
149/* Constants used for validation */
150/* XXX: Can we add clock resolution validation as well as range?  It has
151 *      been reported that Windows timestamps are never more than a
152 *      certain granularity (250ms?), which could be used to help
153 *      eliminate false positives.  Would need to verify this and
154 *      perhaps conservatively implement a check.
155 */
156 /* Minimum time is Jan 1, 1990 00:00:00 */
157#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
158
159 /* Maximum time is Jan 1, 2290 00:00:00
160  * (We hope no one is using Windows by then...)
161  */
162#define REGFI_MTIME_MAX_HIGH       0x03047543
163
164
165/* Flags for the vk records */
166#define REGFI_VK_FLAG_ASCIINAME    0x0001
167#define REGFI_VK_DATA_IN_OFFSET    0x80000000
168#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
169
170
171/* Known key flags */
172/*******************/
173/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
174#define REGFI_NK_FLAG_UNKNOWN1     0x4000
175#define REGFI_NK_FLAG_UNKNOWN2     0x1000
176
177/* This next one shows up in some Vista "software" registries */
178/* XXX: This shows up in the following two SOFTWARE keys in Vista:
179 *   /Wow6432Node/Microsoft
180 *   /Wow6432Node/Microsoft/Cryptography
181 * 
182 * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0
183 */
184#define REGFI_NK_FLAG_UNKNOWN3     0x0080
185
186/* Predefined handle.  Rumor has it that the valuelist count for this key is
187 * where the handle is stored.
188 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
189 */
190#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
191
192/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
193#define REGFI_NK_FLAG_ASCIINAME    0x0020
194
195/* Symlink key. 
196 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
197 */
198#define REGFI_NK_FLAG_LINK         0x0010
199
200/* This key cannot be deleted */
201#define REGFI_NK_FLAG_NO_RM        0x0008
202
203/* Root of a hive */
204#define REGFI_NK_FLAG_ROOT         0x0004
205
206/* Mount point of another hive.  NULL/(default) value indicates which hive
207 * and where in the hive it points to.
208 */
209#define REGFI_NK_FLAG_HIVE_LINK    0x0002
210
211/* These keys shouldn't be stored on disk, according to:
212 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
213 */
214#define REGFI_NK_FLAG_VOLATILE     0x0001
215
216/* Useful for identifying unknown flag types */
217#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
218                                    | REGFI_NK_FLAG_ASCIINAME\
219                                    | REGFI_NK_FLAG_LINK\
220                                    | REGFI_NK_FLAG_NO_RM\
221                                    | REGFI_NK_FLAG_ROOT\
222                                    | REGFI_NK_FLAG_HIVE_LINK\
223                                    | REGFI_NK_FLAG_VOLATILE\
224                                    | REGFI_NK_FLAG_UNKNOWN1\
225                                    | REGFI_NK_FLAG_UNKNOWN2\
226                                    | REGFI_NK_FLAG_UNKNOWN3)
227
228
229#define CHAR_BIT 8
230#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
231                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
232#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
233#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
234
235typedef struct _regfi_nttime
236{
237  uint32_t low;
238  uint32_t high;
239} REGFI_NTTIME;
240
241
242/** HBIN block information
243 * @ingroup regfiMiddleLayer
244 */
245typedef struct _regfi_hbin
246{
247  /** Offset of this HBIN in the registry file */
248  uint32_t file_off;
249
250  /** Number of active records pointing to this block (not used currently) */
251  uint32_t ref_count;
252
253  /** Offset from first hbin block */
254  uint32_t first_hbin_off;
255
256  /** Block size of this block Should be a multiple of 4096 (0x1000) */
257  uint32_t block_size;
258
259  /** Relative offset to next block. 
260   *
261   * @note This value may be unreliable!
262   */
263  uint32_t next_block;
264
265  /** Magic number for the HBIN (should be "hbin"). */
266  uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
267} REGFI_HBIN;
268
269
270/* Subkey List -- list of key offsets and hashed names for consistency */
271typedef struct 
272{
273  /* Virtual offset of NK record or additional subkey list,
274   * depending on this list's type.
275   */
276  uint32_t offset;
277
278  uint32_t hash;
279} REGFI_SUBKEY_LIST_ELEM;
280
281
282/** Subkey-list structure
283 * @ingroup regfiMiddleLayer
284 */
285typedef struct _regfi_subkey_list
286{
287  /* Real offset of this record's cell in the file */
288  uint32_t offset;
289
290  uint32_t cell_size;
291 
292  /* Number of immediate children */
293  uint32_t num_children; 
294
295  /* Total number of keys referenced by this list and it's children */
296  uint32_t num_keys;     
297
298  REGFI_SUBKEY_LIST_ELEM* elements;
299  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
300
301  /* Set if the magic indicates this subkey list points to child subkey lists */
302  bool recursive_type; 
303} REGFI_SUBKEY_LIST;
304
305
306typedef uint32_t REGFI_VALUE_LIST_ELEM;
307/** Value-list structure
308 * @ingroup regfiMiddleLayer
309 */
310typedef struct _regfi_value_list
311{
312  /* Actual number of values referenced by this list. 
313   * May differ from parent key's num_values if there were parsing errors.
314   */
315  uint32_t num_values;
316
317  REGFI_VALUE_LIST_ELEM* elements;
318} REGFI_VALUE_LIST;
319
320
321/** Class name structure (used in storing SysKeys)
322 * @ingroup regfiBase
323 */
324typedef struct _regfi_classname
325{
326  /** As converted to requested REGFI_ENCODING */
327  char* interpreted;
328
329  /** Represents raw buffer read from classname cell.
330   *
331   * Length of this item is specified in the size field.
332   */
333  uint8_t* raw;
334
335  /** Length of the raw data.
336   *
337   * May be shorter than that indicated by parent key.
338   */
339  uint16_t size;
340} REGFI_CLASSNAME;
341
342
343/** Data record structure
344 * @ingroup regfiBase
345 */
346typedef struct _regfi_data
347{
348  /** Data type of this data, as indicated by the referencing VK record. */
349  uint32_t type;
350
351  /** Length of the raw data. */
352  uint32_t size;
353
354  /** This is always present, representing the raw data cell contents. */
355  uint8_t* raw;
356
357  /** Represents the length of the interpreted value. Meaning is type-specific. */
358  uint32_t interpreted_size;
359
360  /** These items represent interpreted versions of the REGFI_DATA::raw field.
361   *
362   * Only use the appropriate member according to the REGFI_DATA::type field.
363   * In the event of an unknown type, use only the REGFI_DATA::raw field.
364   */
365  union _regfi_data_interpreted
366  {
367    /** REG_NONE
368     *
369     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
370     * length.
371     */
372    uint8_t* none; 
373
374    /** REG_SZ
375     *
376     * Stored as a NUL terminated string.  Converted to the specified
377     * REGFI_ENCODING.
378     */
379    uint8_t* string;
380
381    /** REG_EXPAND_SZ
382     *
383     * Stored as a NUL terminated string.  Converted to the specified
384     * REGFI_ENCODING.
385     */
386    uint8_t* expand_string;
387
388    /** REG_BINARY
389     *
390     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
391     * length.
392     */
393    uint8_t* binary;
394
395    /** REG_DWORD */
396    uint32_t dword;
397
398    /** REG_DWORD_BE */
399    uint32_t dword_be;
400
401    /** REG_LINK
402     *
403     * Stored as a NUL terminated string.  Converted to the specified
404     * REGFI_ENCODING.
405     */
406    uint8_t* link;
407
408    /** REG_MULTI_SZ
409     *
410     * Stored as a list of uint8_t* pointers, terminated with a NULL pointer.
411     * Each string element in the list is NUL terminated, and the character set
412     * is determined by the specified REGFI_ENCODING.
413     */
414    uint8_t** multiple_string;
415
416    /** REG_QWORD */
417    uint64_t qword;
418
419    /* The following are treated as binary currently, but this may change in
420     * the future as the formats become better understood.
421     */
422
423    /** REG_RESOURCE_LIST
424     *
425     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
426     * length.
427     */
428    uint8_t* resource_list;
429
430    /** REG_FULL_RESOURCE_DESCRIPTOR
431     *
432     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
433     * length.
434     */
435    uint8_t* full_resource_descriptor;
436
437    /** REG_RESOURCE_REQUIREMENTS_LIST
438     *
439     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
440     * length.
441     */
442    uint8_t* resource_requirements_list;
443  } interpreted;
444} REGFI_DATA;
445
446
447/** Value structure
448 * @ingroup regfiBase
449 */
450typedef struct
451{
452  /** Real offset of this record's cell in the file */
453  uint32_t offset;     
454
455  /** ((start_offset - end_offset) & 0xfffffff8) */
456  uint32_t cell_size;
457
458  /* XXX: deprecated */
459  REGFI_DATA* data;
460
461  /** The name of this value converted to desired REGFI_ENCODING. 
462   *
463   * This conversion typically occurs automatically through REGFI_ITERATOR
464   * settings.  String is NUL terminated.
465   */
466  char*    valuename;
467
468  /** The raw value name
469   *
470   * Length of the buffer is stored in name_length.
471   */
472  uint8_t* valuename_raw;
473
474  /** Length of valuename_raw */
475  uint16_t name_length;
476
477  /** Offset from beginning of this hbin block */
478  uint32_t hbin_off;
479 
480  /** Size of the value's data as reported in the VK record.
481   *
482   * May be different than that obtained while parsing the data cell itself.
483   */
484  uint32_t data_size;
485
486  /** Virtual offset of data cell */
487  uint32_t data_off;
488
489  /** Value's data type */
490  uint32_t type;
491
492  /** VK record's magic number (should be "vk") */
493  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
494
495  /** VK record flags */
496  uint16_t flags;
497
498  /* XXX: A 2-byte field of unknown purpose stored in the VK record */
499  uint16_t unknown1;
500
501  /** Whether or not the data record is stored in the VK record's data_off field.
502   *
503   * This information is derived from the high bit of the raw data size field.
504   */
505  bool     data_in_offset;
506} REGFI_VK_REC;
507
508
509/* Key Security */
510struct _regfi_sk_rec;
511
512/** Security structure
513 * @ingroup regfiBase
514 */
515typedef struct _regfi_sk_rec
516{
517  /** Real file offset of this record */
518  uint32_t offset;
519
520  /** ((start_offset - end_offset) & 0xfffffff8) */
521  uint32_t cell_size;
522
523  /** The stored Windows security descriptor for this SK record */
524  WINSEC_DESC* sec_desc;
525
526  /** Offset of this record from beginning of this hbin block */
527  uint32_t hbin_off;
528 
529  /** Offset of the previous SK record in the linked list of SK records */
530  uint32_t prev_sk_off;
531
532  /** Offset of the next SK record in the linked list of SK records */
533  uint32_t next_sk_off;
534
535  /** Number of keys referencing this SK record */
536  uint32_t ref_count;
537
538  /** Size of security descriptor (sec_desc) */
539  uint32_t desc_size;
540
541  /* XXX: A 2-byte field of unknown purpose */
542  uint16_t unknown_tag;
543
544  /** The magic number for this record (should be "sk") */
545  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
546} REGFI_SK_REC;
547
548
549/** Key structure
550 * @ingroup regfiBase
551 */
552typedef struct
553{
554  /** Real offset of this record's cell in the file */
555  uint32_t offset;
556
557  /** Actual or estimated length of the cell. 
558   * Always in multiples of 8.
559   */
560  uint32_t cell_size;
561
562  /** Preloaded value-list for this key.
563   * This element is loaded automatically when using the iterator interface and
564   * possibly some lower layer interfaces.
565   */
566  REGFI_VALUE_LIST* values;
567
568
569  /** Preloaded subkey-list for this key.
570   * This element is loaded automatically when using the iterator interface and
571   * possibly some lower layer interfaces.
572   */
573  REGFI_SUBKEY_LIST* subkeys;
574 
575  /** Key flags */
576  uint16_t flags;
577
578  /** Magic number of key (should be "nk") */
579  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
580
581  /** Key's last modification time */
582  REGFI_NTTIME mtime;
583
584  /** Length of keyname_raw */
585  uint16_t name_length;
586
587  /** Length of referenced classname */
588  uint16_t classname_length;
589
590  /** The name of this key converted to desired REGFI_ENCODING. 
591   *
592   * This conversion typically occurs automatically through REGFI_ITERATOR
593   * settings.  String is NUL terminated.
594   */
595  char* keyname;
596
597  /** The raw key name
598   *
599   * Length of the buffer is stored in name_length.
600   */
601  uint8_t* keyname_raw;
602
603  /** Virutal offset of parent key */
604  uint32_t parent_off;
605
606  /** Virutal offset of classname key */
607  uint32_t classname_off;
608 
609  /* XXX: max subkey name * 2 */
610  uint32_t max_bytes_subkeyname;
611
612  /* XXX: max subkey classname length (as if) */
613  uint32_t max_bytes_subkeyclassname;
614
615  /* XXX: max valuename * 2 */
616  uint32_t max_bytes_valuename;
617
618  /* XXX: max value data size */
619  uint32_t max_bytes_value;
620 
621  /* XXX: Fields of unknown purpose */
622  uint32_t unknown1;
623  uint32_t unknown2;
624  uint32_t unknown3;
625  uint32_t unk_index;               /* nigel says run time index ? */
626 
627  /** Number of subkeys */
628  uint32_t num_subkeys;
629
630  /** Virtual offset of subkey-list */
631  uint32_t subkeys_off;
632
633  /** Number of values for this key */
634  uint32_t num_values;
635
636  /** Virtual offset of value-list */
637  uint32_t values_off;
638
639  /** Virtual offset of SK record */
640  uint32_t sk_off;
641} REGFI_NK_REC;
642
643
644typedef struct _regfi_raw_file
645{
646  off_t    (* seek)(); /* (REGFI_RAW_FILE* self, off_t offset, int whence) */
647  ssize_t  (* read)(); /* (REGFI_RAW_FILE* self, void* buf, size_t count) */
648
649  uint64_t cur_off;
650  uint64_t size;
651  void*    state;
652} REGFI_RAW_FILE;
653
654
655/** Registry hive file data structure
656 *
657 * This essential structure stores run-time information about a single open
658 * registry hive as well as file header (REGF block) data.  This structure
659 * also stores a list of warnings and error messages generated while parsing
660 * the registry hive.  These can be tuned using @ref regfi_set_message_mask. 
661 * Messages may be retrieved using @ref regfi_get_messages.
662 *
663 * @note If the message mask is set to record any messages, dependent code
664 *       must use @ref regfi_get_messages periodically to clear the message
665 *       queue. Otherwise, this structure will grow in size over time as
666 *       messages queue up.
667 *
668 * @ingroup regfiBase
669 */ 
670typedef struct _regfi_file
671{
672  /* Run-time information */
673  /************************/
674  /* Functions for accessing the file */
675  REGFI_RAW_FILE* cb;
676
677  /* Mutex for all cb access.  This is done to prevent one thread from moving
678   * the file offset while another thread is in the middle of a multi-read
679   * parsing transaction */
680  pthread_mutex_t* cb_lock;
681
682  /* For sanity checking (not part of the registry header) */
683  uint32_t file_length;
684
685  /* Metadata about hbins */
686  range_list* hbins;
687
688  /* Multiple read access allowed, write access is exclusive */
689  pthread_rwlock_t* hbins_lock;
690
691  /* SK record cached since they're repeatedly reused */
692  lru_cache* sk_cache;
693
694  /* Need exclusive access for LRUs, since lookups make changes */
695  pthread_mutex_t* sk_lock;
696
697  /* Error/warning/info messages returned by lower layer functions */
698  char* last_message;
699
700  /* Mask for error message types that will be stored. */
701  uint16_t msg_mask;
702
703
704  /* Data parsed from file header */
705  /********************************/
706  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
707
708 /* These sequence numbers should match if
709  * the hive was properly synced to disk.
710  */
711  uint32_t sequence1;           
712  uint32_t sequence2;
713
714  REGFI_NTTIME mtime;
715  uint32_t major_version;  /* Set to 1 in all known hives */
716  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
717  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
718  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
719
720  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
721  uint32_t last_block; /* Offset to last hbin block in file */
722
723  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
724
725  /* Matches hive's base file name. Stored in UTF-16LE */
726  uint8_t file_name[REGFI_REGF_NAME_SIZE];
727
728  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
729  WINSEC_UUID* log_id;      /* XXX: Unverified. */
730  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
731  uint32_t flags;             /* XXX: Unverified. */
732  uint32_t guid_signature;    /* XXX: Unverified. */
733
734  uint32_t checksum;          /* Stored checksum from file */
735  uint32_t computed_checksum; /* Our own calculation of the checksum.
736                             * (XOR of bytes 0x0000 - 0x01FB) */
737
738  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
739  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
740  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
741  uint32_t boot_type;         /* XXX: Unverified. */
742  uint32_t boot_recover;      /* XXX: Unverified. */
743
744  /* This seems to include random junk.  Possibly unsanitized memory left over
745   * from when header block was written.  For instance, chunks of nk records
746   * can be found, though often it's all 0s. */
747  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
748
749  /* This is likely reserved and unusued currently.  (Should be all 0s.)
750   * Included here for easier access in looking for hidden data
751   * or doing research. */
752  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
753
754} REGFI_FILE;
755
756
757/** Registry hive iterator
758 * @ingroup regfiIteratorLayer
759 */
760typedef struct _regfi_iterator
761{
762  /** The registry hive this iterator is associated with */
763  REGFI_FILE* f;
764
765  /** All current parent keys and associated iterator positions */
766  void_stack* key_positions;
767
768  /** The current key */
769  REGFI_NK_REC* cur_key;
770
771  /** The encoding that all strings are converted to as set during iterator
772   *  creation.
773   */
774  REGFI_ENCODING string_encoding;
775
776  /** Index of the current subkey */
777  uint32_t cur_subkey;
778
779  /** Index of the current value */
780  uint32_t cur_value;
781} REGFI_ITERATOR;
782
783
784typedef struct _regfi_iter_position
785{
786  REGFI_NK_REC* nk;
787  uint32_t cur_subkey;
788  /* We could store a cur_value here as well, but didn't see
789   * the use in it right now.
790   */
791} REGFI_ITER_POSITION;
792
793
794/** General purpose buffer with stored length
795 * @ingroup regfiBottomLayer
796 */
797typedef struct _regfi_buffer
798{
799  uint8_t* buf;
800  uint32_t len;
801} REGFI_BUFFER;
802
803
804
805/******************************************************************************/
806/**
807 * @defgroup regfiBase Base Layer: Essential Functions and Data Structures
808 *
809 * These functions are either necessary for normal use of the regfi API or just
810 * don't fit particularly well in any of the other layers.
811 */
812/******************************************************************************/
813
814/** Parses file headers of an already open registry hive file and
815 *  allocates related structures for further parsing.
816 *
817 * @param fd A file descriptor of an already open file.  Must be seekable.
818 *
819 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
820 *         NULL on error.
821 *
822 * @ingroup regfiBase
823 */
824REGFI_FILE*           regfi_alloc(int fd);
825
826
827/** Parses file headers returned by supplied callback functions.
828 *
829 * This interface is useful if you have a registry hive in memory
830 * or have some other reason to emulate a real file.
831 *
832 * @param file_cb A structure defining the callback functions needed to access the file.
833 *
834 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
835 *         NULL on error.
836 *
837 * @ingroup regfiBase
838 */
839REGFI_FILE*           regfi_alloc_cb(REGFI_RAW_FILE* file_cb);
840
841
842/** Frees a hive's data structures without closing the underlying file.
843 *
844 * @param file The registry structure to free.
845 *
846 * @ingroup regfiBase
847 */
848void                  regfi_free(REGFI_FILE* file);
849
850
851/** Get errors, warnings, and/or verbose information relating to processing of
852 *  the given registry file.
853 *
854 * @param file the structure for the registry file
855 *
856 * @return A newly allocated char* which must be free()d by the caller.
857 *
858 * @ingroup regfiBase
859 */
860char*                 regfi_get_messages(REGFI_FILE* file);
861
862
863/** Set the verbosity level of errors and warnings generated by the library
864 *  (as accessible via regfi_get_messages).
865 *
866 * This may be called at any time and will take effect immediately.
867 *
868 * @param file   the structure for the registry file
869 *
870 * @param mask   an integer representing the types of messages desired.
871 *               Acceptable values are created through bitwise ORs of
872 *               REGFI_MSG_* values.  For instance, if only errors and
873 *               informational messages were desired (but not warnings),
874 *               then one would specify: REGFI_MSG_ERROR|REGFI_MSG_INFO
875 *               New REGFI_FILE structures are created with:
876 *                REGFI_MSG_ERROR|REGFI_MSG_WARN
877 *               Note that error and warning messages will continue to
878 *               accumulate in memory if they are not fetched using
879 *               regfi_get_messages and then freed by the caller.
880 *               To disable error messages entirely, supply 0, which
881 *               will prevent message accumulation. 
882 *
883 * @ingroup regfiBase
884 */
885void                  regfi_set_message_mask(REGFI_FILE* file, uint16_t mask);
886
887
888/* Dispose of previously parsed records */
889
890/** Frees a key structure previously returned by one of the API functions
891 *
892 * XXX: finish documenting
893 *
894 * @ingroup regfiBase
895 */
896void                  regfi_free_key(REGFI_NK_REC* nk);
897
898
899/** Frees a value structure previously returned by one of the API functions
900 *
901 * XXX: finish documenting
902 *
903 * @ingroup regfiBase
904 */
905void                  regfi_free_value(REGFI_VK_REC* vk);
906
907
908
909/******************************************************************************/
910/**
911 * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface
912 *
913 * This top layer of API functions provides an iterator interface which makes
914 * traversing registry data structures easy in both single-threaded and
915 * multi-threaded scenarios.
916 */
917/******************************************************************************/
918
919/** Creates a new iterator for the provided registry file.
920 *
921 * @param file The opened registry file the iterator should be created for.
922 *
923 * @param output_encoding Character encoding that strings should be returned in.
924 *                        Only supply the REGFI_ENCODING_* constants, as others
925 *                        will be rejected.
926 *                        The following values are currently accepted:
927 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
928 *                        REGFI_ENCODING_ASCII
929 *                        REGFI_ENCODING_UTF8
930 *
931 * @return A newly allocated REGFI_ITERATOR.
932 *         Must be free()d with regfi_iterator_free.
933 *
934 * @ingroup regfiIteratorLayer
935 */
936REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* file,
937                                         REGFI_ENCODING output_encoding);
938
939
940/** Frees a registry file iterator previously created by regfi_iterator_new.
941 *
942 * This does not affect the underlying registry file's allocation status.
943 *
944 * @param i the iterator to be freed
945 *
946 * @ingroup regfiIteratorLayer
947 */
948void                  regfi_iterator_free(REGFI_ITERATOR* i);
949
950
951/** Traverse deeper into the registry tree at the current subkey.
952 *
953 * @param i the iterator
954 *
955 * @return  true on success, false on failure. 
956 *          Note that subkey and value indexes are preserved.  That is, if a
957 *          regfi_iterator_up call occurs later (reversing the effect of this
958 *          call) then the subkey and value referenced prior to the
959 *          regfi_iterator_down call will still be referenced.  This  makes
960 *          depth-first iteration particularly easy.
961 *
962 * @ingroup regfiIteratorLayer
963 */
964bool                  regfi_iterator_down(REGFI_ITERATOR* i);
965
966
967/** Traverse up to the current key's parent key.
968 *
969 * @param i the iterator
970 *
971 * @return  true on success, false on failure.  Any subkey or value state
972 *          associated with the current key is lost.
973 *
974 * @ingroup regfiIteratorLayer
975 */
976bool                  regfi_iterator_up(REGFI_ITERATOR* i);
977
978
979/** Traverse up to the root key of the hive.
980 *
981 * @param i the iterator
982 *
983 * @return true on success, false on failure.
984 *
985 * @ingroup regfiIteratorLayer
986 */
987bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
988
989
990/** Traverse down multiple levels in the registry hive.
991 *
992 * XXX: This currently only accepts ASCII key names.  Need to look into
993 *      accepting other encodings.
994 *
995 * @param i    the iterator
996 * @param path a list of key names representing the path.  This list must
997 *             contain NUL terminated strings.  The list itself is
998 *             terminated with a NULL pointer.  All path elements must be
999 *             keys; value names are not accepted (even as the last
1000 *             element).
1001 *
1002 * @return true on success, false on failure.  If any element of path is not
1003 *                 found, false will be returned and the iterator will remain
1004 *                 in its original position.
1005 *
1006 * @ingroup regfiIteratorLayer
1007 */
1008bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
1009
1010
1011/** Returns the currently referenced key.
1012 *
1013 * @param i the iterator
1014 *
1015 * @return A read-only key structure for the current key, or NULL on failure.
1016 *
1017 * @ingroup regfiIteratorLayer
1018 */
1019const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
1020
1021
1022/** Returns the SK (security) record referenced by the current key.
1023 *
1024 * @param i the iterator
1025 *
1026 * @return A read-only SK structure, or NULL on failure.
1027 *
1028 * @ingroup regfiIteratorLayer
1029 */
1030const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
1031
1032
1033/** Sets the internal subkey index to the first subkey referenced by the current
1034 *  key and returns that key.
1035 *
1036 * @param i the iterator
1037 *
1038 * @return A newly allocated key structure for the newly referenced first
1039 *         subkey, or NULL on failure.  Failure may be due to a lack of any
1040 *         subkeys or other errors.  Newly allocated keys must be freed with
1041 *         regfi_free_key.
1042 *
1043 * @ingroup regfiIteratorLayer
1044 */
1045REGFI_NK_REC*         regfi_iterator_first_subkey(REGFI_ITERATOR* i);
1046
1047
1048/** Returns the currently indexed subkey.
1049 *
1050 * @param i the iterator
1051 *
1052 * @return A newly allocated key structure for the currently referenced subkey,
1053 *         or NULL on failure.  Newly allocated keys must be freed with
1054 *         regfi_free_key.
1055 *
1056 * @ingroup regfiIteratorLayer
1057 */
1058REGFI_NK_REC*         regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
1059
1060
1061/** Increments the internal subkey index to the next key in the subkey-list and
1062 *  returns the subkey for that index.
1063 *
1064 * @param i the iterator
1065 *
1066 * @return A newly allocated key structure for the next subkey or NULL on
1067 *         failure.  Newly allocated keys must be freed with regfi_free_key.
1068 *
1069 * @ingroup regfiIteratorLayer
1070 */
1071REGFI_NK_REC*         regfi_iterator_next_subkey(REGFI_ITERATOR* i);
1072
1073
1074/** Searches for a subkey with a given name under the current key.
1075 *
1076 * @param i           the iterator
1077 * @param subkey_name subkey name to search for
1078 *
1079 * @return True if such a subkey was found, false otherwise.  If a subkey is
1080 *         found, the current subkey index is set to that subkey.  Otherwise,
1081 *         the subkey index remains at the same location as before the call.
1082 *
1083 * @ingroup regfiIteratorLayer
1084 */
1085bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i, 
1086                                                 const char* subkey_name);
1087
1088/** Sets the internal value index to the first value referenced by the current
1089 *  key and returns that value.
1090 *
1091 * @param i the iterator
1092 *
1093 * @return  A newly allocated value structure for the newly referenced first
1094 *          value, or NULL on failure.  Failure may be due to a lack of any
1095 *          values or other errors.  Newly allocated keys must be freed with
1096 *          regfi_free_value.
1097 *
1098 * @ingroup regfiIteratorLayer
1099 */
1100REGFI_VK_REC*         regfi_iterator_first_value(REGFI_ITERATOR* i);
1101
1102
1103/** Returns the currently indexed value.
1104 *
1105 * @param i the iterator
1106 *
1107 * @return A newly allocated value structure for the currently referenced value,
1108 *         or NULL on failure.  Newly allocated values must be freed with
1109 *         regfi_free_value.
1110 *
1111 * @ingroup regfiIteratorLayer
1112 */
1113REGFI_VK_REC*         regfi_iterator_cur_value(REGFI_ITERATOR* i);
1114
1115
1116/** Increments the internal value index to the next value in the value-list and
1117 *  returns the value for that index.
1118 *
1119 * @param i the iterator
1120 *
1121 * @return  A newly allocated key structure for the next value or NULL on
1122 *          failure.  Newly allocated keys must be freed with regfi_free_value.
1123 *
1124 * @ingroup regfiIteratorLayer
1125 */
1126REGFI_VK_REC*         regfi_iterator_next_value(REGFI_ITERATOR* i);
1127
1128
1129/** Searches for a value with a given name under the current key.
1130 *
1131 * @param i          the iterator
1132 * @param value_name value name to search for
1133 *
1134 * @return True if such a value was found, false otherwise.  If a value is
1135 *         found, the current value index is set to that value.  Otherwise,
1136 *         the value index remains at the same location as before the call.
1137 *
1138 * @ingroup regfiIteratorLayer
1139 */
1140bool                  regfi_iterator_find_value(REGFI_ITERATOR* i, 
1141                                                const char* value_name);
1142
1143/** Retrieves classname for a given key.
1144 *
1145 * @param i   the iterator
1146 * @param key the key whose classname is desired
1147 *
1148 * @return Returns a newly allocated classname structure, or NULL on failure.
1149 *         Classname structures must be freed with regfi_free_classname.
1150 *
1151 * @ingroup regfiIteratorLayer
1152 */
1153REGFI_CLASSNAME*      regfi_iterator_fetch_classname(REGFI_ITERATOR* i, 
1154                                                     const REGFI_NK_REC* key);
1155
1156
1157/** Retrieves data for a given value.
1158 *
1159 * @param i     the iterator
1160 * @param value the value whose data is desired
1161 *
1162 * @return Returns a newly allocated data structure, or NULL on failure.
1163 *         Data structures must be freed with regfi_free_data.
1164 *
1165 * @ingroup regfiIteratorLayer
1166 */
1167REGFI_DATA*           regfi_iterator_fetch_data(REGFI_ITERATOR* i, 
1168                                                const REGFI_VK_REC* value);
1169
1170
1171
1172/******************************************************************************/
1173/**
1174 * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading
1175 */
1176/******************************************************************************/
1177
1178/** Loads a key at a given file offset along with associated data structures.
1179 *
1180 * XXX: finish documenting
1181 *
1182 * @ingroup regfiGlueLayer
1183 */
1184REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32_t offset, 
1185                                     REGFI_ENCODING output_encoding, 
1186                                     bool strict);
1187
1188
1189/** Loads a value at a given file offset alng with associated data structures.
1190 *
1191 * XXX: finish documenting
1192 *
1193 * @ingroup regfiGlueLayer
1194 */
1195REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32_t offset, 
1196                                       REGFI_ENCODING output_encoding, 
1197                                       bool strict);
1198
1199
1200/** Loads a logical subkey list in its entirety which may span multiple records.
1201 *
1202 * XXX: finish documenting
1203 *
1204 * @ingroup regfiGlueLayer
1205 */
1206REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
1207                                            uint32_t num_keys, uint32_t max_size,
1208                                            bool strict);
1209
1210
1211/** Loads a valuelist.
1212 *
1213 * XXX: finish documenting
1214 *
1215 * @ingroup regfiGlueLayer
1216 */
1217REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, 
1218                                           uint32_t num_values, uint32_t max_size,
1219                                           bool strict);
1220
1221
1222/** Loads a data record which may be contained in the virtual offset, in a
1223 *  single cell, or in multiple cells through big data records.
1224 *
1225 * XXX: finish documenting
1226 *
1227 * @ingroup regfiGlueLayer
1228 */
1229REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32_t voffset,
1230                                      uint32_t length, bool data_in_offset,
1231                                      bool strict);
1232
1233
1234/** Loads the data associated with a big data record at the specified offset.
1235 *
1236 * XXX: finish documenting
1237 *
1238 * @ingroup regfiGlueLayer
1239 */
1240REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32_t offset, 
1241                                          uint32_t data_length,uint32_t cell_length,
1242                                          range_list* used_ranges,
1243                                          bool strict);
1244
1245
1246/** Given raw data, attempts to interpret the data based on a specified registry
1247 *  data type.
1248 *
1249 * XXX: finish documenting
1250 *
1251 * @ingroup regfiGlueLayer
1252 */
1253bool                  regfi_interpret_data(REGFI_FILE* file, 
1254                                           REGFI_ENCODING string_encoding,
1255                                           uint32_t type, REGFI_DATA* data);
1256
1257
1258/** Frees the memory associated with a REGFI_CLASSNAME data structure.
1259 *
1260 * XXX: finish documenting
1261 *
1262 * @ingroup regfiGlueLayer
1263 */
1264void                  regfi_free_classname(REGFI_CLASSNAME* classname);
1265
1266
1267/** Frees the memory associated with a REGFI_DATA data structure.
1268 *
1269 * XXX: finish documenting
1270 *
1271 * @ingroup regfiGlueLayer
1272 */
1273void                  regfi_free_data(REGFI_DATA* data);
1274
1275
1276/* These are cached so return values don't need to be freed. */
1277
1278/** Loads an "sk" security record at the specified offset.
1279 *
1280 * XXX: finish documenting
1281 *
1282 * @ingroup regfiGlueLayer
1283 */
1284const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32_t offset,
1285                                    bool strict);
1286
1287
1288/** Retrieves the HBIN data structure stored at the specified offset.
1289 *
1290 * XXX: finish documenting
1291 *
1292 * @ingroup regfiGlueLayer
1293 */
1294const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
1295
1296
1297
1298/******************************************************************************/
1299/**
1300 * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access
1301 */
1302/******************************************************************************/
1303
1304REGFI_FILE*           regfi_parse_regf(REGFI_RAW_FILE* file_cb, bool strict);
1305REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, 
1306                                       bool strict);
1307
1308
1309/** Parses an NK record at the specified offset
1310 *
1311 * @param file     the registry file structure
1312 * @param offset   the offset of the cell (not the record) to be parsed.
1313 * @param max_size the maximum size the NK cell could be. (for validation)
1314 * @param strict   if true, rejects any malformed records.  Otherwise,
1315 *                 tries to minimally validate integrity.
1316 *
1317 * @return A newly allocated NK record structure, or NULL on failure.
1318 *
1319 * @ingroup regfiParseLayer
1320 */
1321REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
1322                                     uint32_t max_size, bool strict);
1323
1324
1325/** Parses a single cell containing a subkey-list record.
1326 *
1327 * XXX: finish documenting
1328 *
1329 * @ingroup regfiParseLayer
1330 */
1331REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
1332                                             uint32_t max_size, bool strict);
1333
1334
1335/** Parses a VK (value) record at the specified offset
1336 *
1337 * XXX: finish documenting
1338 *
1339 * @ingroup regfiParseLayer
1340 */
1341REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32_t offset, 
1342                                     uint32_t max_size, bool strict);
1343
1344
1345/** Parses an SK (security) record at the specified offset
1346 *
1347 * XXX: finish documenting
1348 *
1349 * @ingroup regfiParseLayer
1350 */
1351REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32_t offset, 
1352                                     uint32_t max_size, bool strict);
1353
1354
1355/** Retrieves information on all cells in the registry hive which are
1356 *  currently in the unallocated status. 
1357 *
1358 * The unallocated status is determined based soley on the cell length sign.
1359 *
1360 * XXX: finish documenting
1361 *
1362 * @ingroup regfiParseLayer
1363 */
1364range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
1365
1366
1367/** Helper function to parse a cell
1368 *
1369 * XXX: finish documenting
1370 *
1371 * @ingroup regfiParseLayer
1372 */
1373bool                  regfi_parse_cell(REGFI_RAW_FILE* file_cb, uint32_t offset,
1374                                       uint8_t* hdr, uint32_t hdr_len,
1375                                       uint32_t* cell_length, bool* unalloc);
1376
1377
1378/** Parses a classname cell
1379 *
1380 * XXX: finish documenting
1381 *
1382 * @ingroup regfiParseLayer
1383 */
1384uint8_t*                regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
1385                                            uint16_t* name_length, 
1386                                            uint32_t max_size, bool strict);
1387
1388
1389/** Parses a single-cell data record
1390 *
1391 * XXX: finish documenting
1392 *
1393 * @ingroup regfiParseLayer
1394 */
1395REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32_t offset,
1396                                       uint32_t length, bool strict);
1397
1398
1399/** Parses a "little data" record which is stored entirely within the
1400 *  provided virtual offset.
1401 *
1402 * XXX: finish documenting
1403 *
1404 * @ingroup regfiParseLayer
1405 */
1406REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, 
1407                                              uint32_t length, bool strict);
1408
1409
1410/******************************************************************************/
1411/*    Private Functions                                                       */
1412/******************************************************************************/
1413REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file, 
1414                                    REGFI_ENCODING output_encoding);
1415void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
1416
1417off_t                 regfi_raw_seek(REGFI_RAW_FILE* self, 
1418                                     off_t offset, int whence);
1419ssize_t               regfi_raw_read(REGFI_RAW_FILE* self, 
1420                                     void* buf, size_t count);
1421off_t                 regfi_seek(REGFI_RAW_FILE* file_cb, 
1422                                 off_t offset, int whence);
1423uint32_t              regfi_read(REGFI_RAW_FILE* file_cb, 
1424                                 uint8_t* buf, uint32_t* length);
1425
1426const char*           regfi_type_val2str(unsigned int val);
1427int                   regfi_type_str2val(const char* str);
1428
1429char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
1430char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
1431char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
1432char*                 regfi_get_group(WINSEC_DESC* sec_desc);
1433
1434REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists, 
1435                                              REGFI_SUBKEY_LIST** lists,
1436                                              bool strict);
1437REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1438                                                uint32_t max_size, bool strict,
1439                                                uint8_t depth_left);
1440void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type, 
1441                                        const char* fmt, ...);
1442REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
1443REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
1444int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1445int32_t               regfi_conv_charset(const char* input_charset, 
1446                                         const char* output_charset,
1447                                         uint8_t* input, char* output, 
1448                                         uint32_t input_len, uint32_t output_max);
1449REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
1450
1451/* XXX: move to base API and document */
1452void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
1453time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
1454
1455
1456void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk, 
1457                             REGFI_ENCODING output_encoding, bool strict);
1458void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk, 
1459                               REGFI_ENCODING output_encoding, bool strict);
1460
1461
1462#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.