source: trunk/include/regfi.h @ 209

Last change on this file since 209 was 209, checked in by tim, 14 years ago

worked on pyregfi value data interface

added initial scons target for API/devel documentation

  • Property svn:keywords set to Id
File size: 45.9 KB
Line 
1/*
2 * Copyright (C) 2005-2010 Timothy D. Morgan
3 * Copyright (C) 2010 Michael Cohen
4 * Copyright (C) 2005 Gerald (Jerry) Carter
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; version 3 of the License.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
18 *
19 * $Id: regfi.h 209 2010-10-09 21:55:44Z tim $
20 */
21
22/**
23 * @file
24 * Windows NT (and later) read-only registry library
25 *
26 * This library is intended for use in digital forensics investigations, but
27 * is likely useful in other applications.
28 *
29 * Branched from Samba project Subversion repository, version #6903:
30 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
31 *
32 * Since then, it has been heavily rewritten, simplified, and improved.
33 */
34
35/**
36 * @mainpage Home
37 *
38 * The regfi library is a read-only NT registry library which serves as the main
39 * engine behind the reglookup tool.  It is designed with digital forensic
40 * analysis in mind, but it should also be useful in other tools which need to
41 * efficiently traverse and query registry data structures.
42 *
43 * The library is broken down into four main parts, the
44 * @ref regfiBase "Base Layer", which any code dependent on the library will
45 * likely need to rely on, as well as three main functional layers:
46 * @li @ref regfiIteratorLayer
47 * @li @ref regfiGlueLayer
48 * @li @ref regfiParseLayer
49 *
50 * Most users will find that a combination of the Base Layer and the Iterator Layer
51 * will be sufficient for accessing registry hive files.  Those who are willing
52 * to dive deep into registry data structures, for instance to recover deleted
53 * data structures or to research Windows registry behavior in detail, will
54 * find the Parse Layer to be quite useful.
55 */
56
57
58#ifndef _REGFI_H
59#define _REGFI_H
60
61#include <stdlib.h>
62#include <stdio.h>
63#include <stdbool.h>
64#include <string.h>
65#include <errno.h>
66#include <time.h>
67#include <fcntl.h>
68#include <sys/stat.h>
69#include <sys/types.h>
70#include <unistd.h>
71#include <iconv.h>
72#include <pthread.h>
73#include <talloc.h>
74
75/* regfi headers */
76#include <byteorder.h>
77#include <winsec.h>
78#include <void_stack.h>
79#include <range_list.h>
80#include <lru_cache.h>
81
82/* GCC-specific macro for library exports */
83#ifdef _EXPORT
84#undef _EXPORT
85#endif
86#define _EXPORT __attribute__((visibility("default")))
87
88
89
90/******************************************************************************/
91/* Constants for use while interacting with the library                       */
92/******************************************************************************/
93
94/* regfi library error message types */
95#define REGFI_LOG_INFO  0x0001
96#define REGFI_LOG_WARN  0x0004
97#define REGFI_LOG_ERROR 0x0010
98#define REGFI_DEFAULT_LOG_MASK REGFI_LOG_ERROR|REGFI_LOG_WARN
99
100/* regfi library supported character encodings */
101/* UTF16LE is not supported for output */
102typedef enum {
103  REGFI_ENCODING_DEFAULT  = 0,
104  REGFI_ENCODING_ASCII =   0,
105  REGFI_ENCODING_UTF8  =  1,
106  REGFI_ENCODING_UTF16LE = 2,
107  REGFI_NUM_ENCODINGS  =  3
108} REGFI_ENCODING;
109
110/* Registry data types */
111typedef enum {
112  REG_NONE                   =    0,
113  REG_SZ                     =    1,
114  REG_EXPAND_SZ              =    2,
115  REG_BINARY                 =    3,
116  REG_DWORD                  =    4,
117  REG_DWORD_LE               =    4 , /* DWORD, little endian */
118  REG_DWORD_BE               =    5 , /* DWORD, big endian */
119  REG_LINK                   =    6,
120  REG_MULTI_SZ               =    7,
121  REG_RESOURCE_LIST          =    8,
122  REG_FULL_RESOURCE_DESCRIPTOR=   9,
123  REG_RESOURCE_REQUIREMENTS_LIST= 10,
124  REG_QWORD                     = 11, /* 64-bit little endian */
125/* XXX: Has MS defined a REG_QWORD_BE? */
126/* Not a real type in the registry */
127  REG_KEY                 =   0x7FFFFFFF
128} REGFI_DATA_TYPE;
129#define REGFI_OFFSET_NONE          0xffffffff
130
131
132
133/******************************************************************************/
134/* Various resource limits and related constants                              */
135/******************************************************************************/
136
137/* Flags determining whether or not to cache various record types internally */
138#define REGFI_CACHE_SK             0
139
140/* This maximum depth is described here:
141 * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
142 */
143#define REGFI_MAX_DEPTH            512
144
145/* This limit defines the maximum number of levels deep that ri subkey list
146 * trees can go.
147 */
148/* XXX: This is totally arbitrary right now.
149 *      The actual limit may need to be discovered by experimentation.
150 */
151#define REGFI_MAX_SUBKEY_DEPTH     255
152
153
154/******************************************************************************/
155/* Symbols for internal use                                                   */
156/******************************************************************************/
157
158/* Global thread-local storage key */
159pthread_key_t regfi_log_key;
160
161/* Header sizes and magic number lengths for various records */
162#define REGFI_HBIN_ALLOC           0x1000 /* Minimum allocation unit for HBINs */
163#define REGFI_REGF_SIZE            0x1000 /* "regf" header block size */
164#define REGFI_REGF_MAGIC_SIZE      4
165#define REGFI_REGF_NAME_SIZE       64
166#define REGFI_REGF_RESERVED1_SIZE  340
167#define REGFI_REGF_RESERVED2_SIZE  3528
168#define REGFI_HBIN_MAGIC_SIZE      4
169#define REGFI_CELL_MAGIC_SIZE      2
170#define REGFI_HBIN_HEADER_SIZE     0x20
171#define REGFI_NK_MIN_LENGTH        0x4C
172#define REGFI_VK_MIN_LENGTH        0x14
173#define REGFI_SK_MIN_LENGTH        0x14
174#define REGFI_SUBKEY_LIST_MIN_LEN  0x4
175#define REGFI_BIG_DATA_MIN_LENGTH  0xC
176
177
178/* Constants used for validation */
179/* XXX: Can we add clock resolution validation as well as range?  It has
180 *      been reported that Windows timestamps are never more than a
181 *      certain granularity (250ms?), which could be used to help
182 *      eliminate false positives.  Would need to verify this and
183 *      perhaps conservatively implement a check.
184 */
185 /* Minimum time is Jan 1, 1990 00:00:00 */
186#define REGFI_MTIME_MIN_HIGH       0x01B41E6D
187
188 /* Maximum time is Jan 1, 2290 00:00:00
189  * (We hope no one is using Windows by then...)
190  */
191#define REGFI_MTIME_MAX_HIGH       0x03047543
192
193
194/* Flags for the vk records */
195#define REGFI_VK_FLAG_ASCIINAME    0x0001
196#define REGFI_VK_DATA_IN_OFFSET    0x80000000
197#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
198
199
200/* Known key flags */
201/*******************/
202/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
203#define REGFI_NK_FLAG_UNKNOWN1     0x4000
204#define REGFI_NK_FLAG_UNKNOWN2     0x1000
205
206/* This next one shows up in some Vista "software" registries */
207/* XXX: This shows up in the following two SOFTWARE keys in Vista:
208 *   /Wow6432Node/Microsoft
209 *   /Wow6432Node/Microsoft/Cryptography
210 * 
211 * It comes along with UNKNOWN2 and ASCIINAME for a total flags value of 0x10A0
212 */
213#define REGFI_NK_FLAG_UNKNOWN3     0x0080
214
215/* Predefined handle.  Rumor has it that the valuelist count for this key is
216 * where the handle is stored.
217 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
218 */
219#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
220
221/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
222#define REGFI_NK_FLAG_ASCIINAME    0x0020
223
224/* Symlink key. 
225 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
226 */
227#define REGFI_NK_FLAG_LINK         0x0010
228
229/* This key cannot be deleted */
230#define REGFI_NK_FLAG_NO_RM        0x0008
231
232/* Root of a hive */
233#define REGFI_NK_FLAG_ROOT         0x0004
234
235/* Mount point of another hive.  NULL/(default) value indicates which hive
236 * and where in the hive it points to.
237 */
238#define REGFI_NK_FLAG_HIVE_LINK    0x0002
239
240/* These keys shouldn't be stored on disk, according to:
241 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
242 */
243#define REGFI_NK_FLAG_VOLATILE     0x0001
244
245/* Useful for identifying unknown flag types */
246#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
247                                    | REGFI_NK_FLAG_ASCIINAME\
248                                    | REGFI_NK_FLAG_LINK\
249                                    | REGFI_NK_FLAG_NO_RM\
250                                    | REGFI_NK_FLAG_ROOT\
251                                    | REGFI_NK_FLAG_HIVE_LINK\
252                                    | REGFI_NK_FLAG_VOLATILE\
253                                    | REGFI_NK_FLAG_UNKNOWN1\
254                                    | REGFI_NK_FLAG_UNKNOWN2\
255                                    | REGFI_NK_FLAG_UNKNOWN3)
256
257
258#ifndef CHAR_BIT
259#define CHAR_BIT 8
260#endif
261
262#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
263                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
264#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
265#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
266
267
268
269/******************************************************************************/
270/* Structures                                                                 */
271/******************************************************************************/
272
273typedef struct _regfi_nttime
274{
275  uint32_t low;
276  uint32_t high;
277} REGFI_NTTIME;
278
279
280typedef struct _regfi_log
281{
282  /* Error/warning/info messages returned by lower layer functions */
283  char* messages;
284
285  /* Mask for error message types that will be stored. */
286  uint16_t msg_mask;
287
288} REGFI_LOG;
289
290
291/** HBIN block information
292 * @ingroup regfiMiddleLayer
293 */
294typedef struct _regfi_hbin
295{
296  /** Offset of this HBIN in the registry file */
297  uint32_t file_off;
298
299  /** Number of active records pointing to this block (not used currently) */
300  uint32_t ref_count;
301
302  /** Offset from first hbin block */
303  uint32_t first_hbin_off;
304
305  /** Block size of this block Should be a multiple of 4096 (0x1000) */
306  uint32_t block_size;
307
308  /** Relative offset to next block. 
309   *
310   * @note This value may be unreliable!
311   */
312  uint32_t next_block;
313
314  /** Magic number for the HBIN (should be "hbin"). */
315  uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
316} REGFI_HBIN;
317
318
319/* Subkey List -- list of key offsets and hashed names for consistency */
320typedef struct 
321{
322  /* Virtual offset of NK record or additional subkey list,
323   * depending on this list's type.
324   */
325  uint32_t offset;
326
327  uint32_t hash;
328} REGFI_SUBKEY_LIST_ELEM;
329
330
331/** Subkey-list structure
332 * @ingroup regfiMiddleLayer
333 */
334typedef struct _regfi_subkey_list
335{
336  /* Real offset of this record's cell in the file */
337  uint32_t offset;
338
339  uint32_t cell_size;
340 
341  /* Number of immediate children */
342  uint32_t num_children;
343
344  /* Total number of keys referenced by this list and its children */
345  uint32_t num_keys;
346
347  REGFI_SUBKEY_LIST_ELEM* elements;
348  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
349
350  /* Set if the magic indicates this subkey list points to child subkey lists */
351  bool recursive_type;
352} REGFI_SUBKEY_LIST;
353
354
355typedef uint32_t REGFI_VALUE_LIST_ELEM;
356/** Value-list structure
357 * @ingroup regfiMiddleLayer
358 */
359typedef struct _regfi_value_list
360{
361  /* Real offset of this record's cell in the file */
362  uint32_t offset;
363
364  uint32_t cell_size;
365
366  /* Actual number of values referenced by this list. 
367   * May differ from parent key's num_values if there were parsing errors.
368   */
369  uint32_t num_values;
370
371  REGFI_VALUE_LIST_ELEM* elements;
372} REGFI_VALUE_LIST;
373
374
375/** Class name structure (used in storing SysKeys)
376 * @ingroup regfiBase
377 */
378typedef struct _regfi_classname
379{
380  /** Real offset of this record's cell in the file */
381  uint32_t offset;
382
383  /** As converted to requested REGFI_ENCODING */
384  char* interpreted;
385
386  /** Represents raw buffer read from classname cell.
387   *
388   * Length of this item is specified in the size field.
389   */
390  uint8_t* raw;
391
392  /** Length of the raw data.
393   *
394   * May be shorter than that indicated by parent key.
395   */
396  uint16_t size;
397} REGFI_CLASSNAME;
398
399
400/** Data record structure
401 * @ingroup regfiBase
402 */
403typedef struct _regfi_data
404{
405  /* XXX: this isn't populated yet. Should set it to start of data cell
406   *      or big data cell.
407   */
408  uint32_t offset;
409
410  /** Data type of this data, as indicated by the referencing VK record. */
411  REGFI_DATA_TYPE type;
412
413  /** Length of the raw data. */
414  uint32_t size;
415
416  /** This is always present, representing the raw data cell contents. */
417  uint8_t* raw;
418
419  /** Represents the length of the interpreted value. Meaning is type-specific.
420   *  Will be 0 if interpretation failed for any reason.
421   */
422  uint32_t interpreted_size;
423
424  /** These items represent interpreted versions of the REGFI_DATA::raw field.
425   *
426   * Only use the appropriate member according to the REGFI_DATA::type field.
427   * In the event of an unknown type, use only the REGFI_DATA::raw field.
428   */
429  union _regfi_data_interpreted
430  {
431    /** REG_NONE
432     *
433     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
434     * length.
435     */
436    uint8_t* none; 
437
438    /** REG_SZ
439     *
440     * Stored as a NUL terminated string.  Converted to the specified
441     * REGFI_ENCODING.
442     */
443    uint8_t* string;
444
445    /** REG_EXPAND_SZ
446     *
447     * Stored as a NUL terminated string.  Converted to the specified
448     * REGFI_ENCODING.
449     */
450    uint8_t* expand_string;
451
452    /** REG_BINARY
453     *
454     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
455     * length.
456     */
457    uint8_t* binary;
458
459    /** REG_DWORD */
460    uint32_t dword;
461
462    /** REG_DWORD_BE */
463    uint32_t dword_be;
464
465    /** REG_LINK
466     *
467     * Stored as a NUL terminated string.  Converted to the specified
468     * REGFI_ENCODING.
469     */
470    uint8_t* link;
471
472    /** REG_MULTI_SZ
473     *
474     * Stored as a list of uint8_t* pointers, terminated with a NULL pointer.
475     * Each string element in the list is NUL terminated, and the character set
476     * is determined by the specified REGFI_ENCODING.
477     */
478    uint8_t** multiple_string;
479
480    /** REG_QWORD */
481    uint64_t qword;
482
483    /* The following are treated as binary currently, but this may change in
484     * the future as the formats become better understood.
485     */
486
487    /** REG_RESOURCE_LIST
488     *
489     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
490     * length.
491     */
492    uint8_t* resource_list;
493
494    /** REG_FULL_RESOURCE_DESCRIPTOR
495     *
496     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
497     * length.
498     */
499    uint8_t* full_resource_descriptor;
500
501    /** REG_RESOURCE_REQUIREMENTS_LIST
502     *
503     * Stored as a raw buffer.  Use REGFI_DATA::interpreted_size to determine
504     * length.
505     */
506    uint8_t* resource_requirements_list;
507  } interpreted;
508} REGFI_DATA;
509
510
511/** Value structure
512 * @ingroup regfiBase
513 */
514typedef struct _regfi_vk
515{
516  /** Real offset of this record's cell in the file */
517  uint32_t offset;     
518
519  /** ((start_offset - end_offset) & 0xfffffff8) */
520  uint32_t cell_size;
521
522  /** The name of this value converted to desired REGFI_ENCODING. 
523   *
524   * This conversion typically occurs automatically through REGFI_ITERATOR
525   * settings.  String is NUL terminated.
526   */
527  char* name;
528
529  /** The raw value name
530   *
531   * Length of the buffer is stored in name_length.
532   */
533  uint8_t* name_raw;
534
535  /** Length of name_raw */
536  uint16_t name_length;
537
538  /** Offset from beginning of this hbin block */
539  uint32_t hbin_off;
540 
541  /** Size of the value's data as reported in the VK record.
542   *
543   * May be different than that obtained while parsing the data cell itself.
544   */
545  uint32_t data_size;
546
547  /** Virtual offset of data cell */
548  uint32_t data_off;
549
550  /** Value's data type */
551  REGFI_DATA_TYPE type;
552
553  /** VK record's magic number (should be "vk") */
554  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
555
556  /** VK record flags */
557  uint16_t flags;
558
559  /* XXX: A 2-byte field of unknown purpose stored in the VK record */
560  uint16_t unknown1;
561
562  /** Whether or not the data record is stored in the VK record's data_off field.
563   *
564   * This information is derived from the high bit of the raw data size field.
565   */
566  bool     data_in_offset;
567
568  /* XXX: deprecated */
569  REGFI_DATA* data;
570
571} REGFI_VK;
572
573
574/* Key Security */
575struct _regfi_sk;
576
577/** Security structure
578 * @ingroup regfiBase
579 */
580typedef struct _regfi_sk
581{
582  /** Real file offset of this record */
583  uint32_t offset;
584
585  /** ((start_offset - end_offset) & 0xfffffff8) */
586  uint32_t cell_size;
587
588  /** The stored Windows security descriptor for this SK record */
589  WINSEC_DESC* sec_desc;
590
591  /** Offset of this record from beginning of this hbin block */
592  uint32_t hbin_off;
593 
594  /** Offset of the previous SK record in the linked list of SK records */
595  uint32_t prev_sk_off;
596
597  /** Offset of the next SK record in the linked list of SK records */
598  uint32_t next_sk_off;
599
600  /** Number of keys referencing this SK record */
601  uint32_t ref_count;
602
603  /** Size of security descriptor (sec_desc) */
604  uint32_t desc_size;
605
606  /* XXX: A 2-byte field of unknown purpose */
607  uint16_t unknown_tag;
608
609  /** The magic number for this record (should be "sk") */
610  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
611} REGFI_SK;
612
613
614/** Key structure
615 * @ingroup regfiBase
616 */
617typedef struct _regfi_nk
618{
619  /** Real offset of this record's cell in the file */
620  uint32_t offset;
621
622  /** Actual or estimated length of the cell. 
623   * Always in multiples of 8.
624   */
625  uint32_t cell_size;
626
627  /** Preloaded value-list for this key.
628   * This element is loaded automatically when using the iterator interface and
629   * possibly some lower layer interfaces.
630   */
631  REGFI_VALUE_LIST* values;
632
633
634  /** Preloaded subkey-list for this key.
635   * This element is loaded automatically when using the iterator interface and
636   * possibly some lower layer interfaces.
637   */
638  REGFI_SUBKEY_LIST* subkeys;
639 
640  /** Key flags */
641  uint16_t flags;
642
643  /** Magic number of key (should be "nk") */
644  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
645
646  /** Key's last modification time */
647  REGFI_NTTIME mtime;
648
649  /** Length of keyname_raw */
650  uint16_t name_length;
651
652  /** Length of referenced classname */
653  uint16_t classname_length;
654
655  /** The name of this key converted to desired REGFI_ENCODING. 
656   *
657   * This conversion typically occurs automatically through REGFI_ITERATOR
658   * settings.  String is NUL terminated.
659   */
660  char* name;
661
662  /** The raw key name
663   *
664   * Length of the buffer is stored in name_length.
665   */
666  uint8_t* name_raw;
667
668  /** Virutal offset of parent key */
669  uint32_t parent_off;
670
671  /** Virutal offset of classname key */
672  uint32_t classname_off;
673 
674  /* XXX: max subkey name * 2 */
675  uint32_t max_bytes_subkeyname;
676
677  /* XXX: max subkey classname length (as if) */
678  uint32_t max_bytes_subkeyclassname;
679
680  /* XXX: max value name * 2 */
681  uint32_t max_bytes_valuename;
682
683  /* XXX: max value data size */
684  uint32_t max_bytes_value;
685 
686  /* XXX: Fields of unknown purpose */
687  uint32_t unknown1;
688  uint32_t unknown2;
689  uint32_t unknown3;
690  uint32_t unk_index;               /* nigel says run time index ? */
691 
692  /** Number of subkeys */
693  uint32_t num_subkeys;
694
695  /** Virtual offset of subkey-list */
696  uint32_t subkeys_off;
697
698  /** Number of values for this key */
699  uint32_t num_values;
700
701  /** Virtual offset of value-list */
702  uint32_t values_off;
703
704  /** Virtual offset of SK record */
705  uint32_t sk_off;
706} REGFI_NK;
707
708
709typedef struct _regfi_raw_file
710{
711  off_t    (* seek)(); /* (REGFI_RAW_FILE* self, off_t offset, int whence) */
712  ssize_t  (* read)(); /* (REGFI_RAW_FILE* self, void* buf, size_t count) */
713
714  uint64_t cur_off;
715  uint64_t size;
716  void*    state;
717} REGFI_RAW_FILE;
718
719
720/** Registry hive file data structure
721 *
722 * This essential structure stores run-time information about a single open
723 * registry hive as well as file header (REGF block) data.  This structure
724 * also stores a list of warnings and error messages generated while parsing
725 * the registry hive.  These can be tuned using @ref regfi_set_message_mask. 
726 * Messages may be retrieved using @ref regfi_log_get_str.
727 *
728 * @note If the message mask is set to record any messages, dependent code
729 *       must use @ref regfi_log_get_str periodically to clear the message
730 *       queue. Otherwise, this structure will grow in size over time as
731 *       messages queue up.
732 *
733 * @ingroup regfiBase
734 */ 
735typedef struct _regfi_file
736{
737  /* Data parsed from file header */
738  /********************************/
739  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
740
741 /* These sequence numbers should match if
742  * the hive was properly synced to disk.
743  */
744  uint32_t sequence1;           
745  uint32_t sequence2;
746
747  REGFI_NTTIME mtime;
748  uint32_t major_version;  /* Set to 1 in all known hives */
749  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
750  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
751  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
752
753  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
754  uint32_t last_block; /* Offset to last hbin block in file */
755
756  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
757
758  /* Matches hive's base file name. Stored in UTF-16LE */
759  uint8_t file_name[REGFI_REGF_NAME_SIZE];
760
761  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
762  WINSEC_UUID* log_id;      /* XXX: Unverified. */
763  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
764  uint32_t flags;             /* XXX: Unverified. */
765  uint32_t guid_signature;    /* XXX: Unverified. */
766
767  uint32_t checksum;          /* Stored checksum from file */
768  uint32_t computed_checksum; /* Our own calculation of the checksum.
769                             * (XOR of bytes 0x0000 - 0x01FB) */
770
771  WINSEC_UUID* thaw_tm_id;  /* XXX: Unverified. */
772  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
773  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
774  uint32_t boot_type;         /* XXX: Unverified. */
775  uint32_t boot_recover;      /* XXX: Unverified. */
776
777  /* This seems to include random junk.  Possibly unsanitized memory left over
778   * from when header block was written.  For instance, chunks of nk records
779   * can be found, though often it's all 0s. */
780  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
781
782  /* This is likely reserved and unusued currently.  (Should be all 0s.)
783   * Included here for easier access in looking for hidden data
784   * or doing research. */
785  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
786
787
788  /* Run-time information */
789  /************************/
790  /* For sanity checking (not part of the registry header) */
791  uint32_t file_length;
792
793  /** The encoding that all strings are converted to during interpretation.
794   */
795  REGFI_ENCODING string_encoding;
796
797  /* Functions for accessing the file */
798  REGFI_RAW_FILE* cb;
799
800  /* Mutex for all cb access.  This is done to prevent one thread from moving
801   * the file offset while another thread is in the middle of a multi-read
802   * parsing transaction */
803  pthread_mutex_t cb_lock;
804
805  /* Metadata about hbins */
806  range_list* hbins;
807
808  /* Multiple read access allowed, write access is exclusive */
809  pthread_rwlock_t hbins_lock;
810
811  /* SK record cached since they're repeatedly reused */
812  lru_cache* sk_cache;
813
814  /* Need exclusive access for LRUs, since lookups make changes */
815  pthread_mutex_t sk_lock;
816
817} REGFI_FILE;
818
819
820/** Registry hive iterator
821 * @ingroup regfiIteratorLayer
822 */
823typedef struct _regfi_iterator
824{
825  /** The registry hive this iterator is associated with */
826  REGFI_FILE* f;
827
828  /** All current parent keys and associated iterator positions */
829  void_stack* key_positions;
830
831  /** The current key */
832  REGFI_NK* cur_key;
833
834  /** Index of the current subkey */
835  uint32_t cur_subkey;
836
837  /** Index of the current value */
838  uint32_t cur_value;
839} REGFI_ITERATOR;
840
841
842typedef struct _regfi_iter_position
843{
844  REGFI_NK* nk;
845  uint32_t cur_subkey;
846  /* We could store a cur_value here as well, but didn't see
847   * the use in it right now.
848   */
849} REGFI_ITER_POSITION;
850
851
852/** General purpose buffer with stored length
853 * @ingroup regfiBottomLayer
854 */
855typedef struct _regfi_buffer
856{
857  uint8_t* buf;
858  uint32_t len;
859} REGFI_BUFFER;
860
861
862
863/******************************************************************************/
864/**
865 * @defgroup regfiBase Base Layer: Essential Functions and Data Structures
866 *
867 * These functions are either necessary for normal use of the regfi API or just
868 * don't fit particularly well in any of the other layers.
869 */
870/******************************************************************************/
871
872/** Parses file headers of an already open registry hive file and
873 *  allocates related structures for further parsing.
874 *
875 * @param fd A file descriptor of an already open file.  Must be seekable.
876 *
877 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
878 *         NULL on error.  Use regfi_free to free the returned REGFI_FILE.
879 *
880 * @ingroup regfiBase
881 */
882_EXPORT
883REGFI_FILE* regfi_alloc(int fd, REGFI_ENCODING output_encoding);
884
885
886/** Parses file headers returned by supplied callback functions.
887 *
888 * This interface is useful if you have a registry hive in memory
889 * or have some other reason to emulate a real file.
890 *
891 * @param file_cb A structure defining the callback functions needed to access the file.
892 *
893 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
894 *         NULL on error.  Use regfi_free to free the returned REGFI_FILE.
895 *
896 * @ingroup regfiBase
897 */
898_EXPORT
899REGFI_FILE* regfi_alloc_cb(REGFI_RAW_FILE* file_cb,
900                           REGFI_ENCODING output_encoding);
901
902
903/** Frees a hive's data structures without closing the underlying file.
904 *
905 * @param file The registry structure to free.
906 *
907 * @ingroup regfiBase
908 */
909_EXPORT
910void regfi_free(REGFI_FILE* file);
911
912
913/** Get errors, warnings, and/or verbose information relating to processing of
914 *  the given registry file.
915 *
916 * @return A newly allocated char* which must be free()d by the caller.
917 *
918 * @ingroup regfiBase
919 */
920_EXPORT
921char* regfi_log_get_str();
922
923
924/** Set the verbosity level of messages generated by the library for the
925 *  current thread.
926 *
927 * @param mask   An integer representing the types of messages desired.
928 *               Acceptable values are created through bitwise ORs of
929 *               REGFI_LOG_* values.  For instance, if only errors and
930 *               informational messages were desired (but not warnings),
931 *               then one would specify: REGFI_LOG_ERROR|REGFI_LOG_INFO
932 *               By default the message mask is: REGFI_LOG_ERROR|REGFI_LOG_WARN.
933 *
934 * @return       true on success and false on failure.  Failure occurs if
935 *               underlying pthread functions fail.  errno is set in this case.
936 *
937 * Message masks are set in a thread-specific way.  If one were to set a message
938 * mask in one thread and then spawn a new thread, then the new thread will have
939 * it's message mask reset to the default.  This function may be called at any
940 * time and will take effect immediately for the current thread.
941 *
942 * @note When a non-zero message mask is set, messages will
943 *       accumulate in memory without limit if they are not fetched using
944 *       @ref regfi_get_log_str and subsequently freed by the caller.  It is
945 *       recommended that messsages be fetched after each regfi API call in
946 *       order to provide the most context.
947 *
948 * @ingroup regfiBase
949 */
950_EXPORT
951bool regfi_log_set_mask(uint16_t mask);
952
953
954/* Dispose of previously parsed records */
955
956/** Frees a record previously returned by one of the API functions.
957 *
958 * Can be used to free REGFI_NK, REGFI_VK, REGFI_SK, REGFI_DATA, and
959 * REGFI_CLASSNAME records.
960 *
961 * @note The "const" in the data type is a bit misleading and is there just for
962 * convenience.  Since records returned previously must not be modified by users
963 * of the API due to internal caching, these are returned as const, so this
964 * function is const to make passing back in easy.
965 *
966 * @ingroup regfiBase
967 */
968_EXPORT
969void regfi_free_record(const void* record);
970
971
972/** Retrieves number of subkeys referenced by this key.
973 *
974 * Number of subkeyss in key structure and subkey list structure could differ,
975 * so this provides a standard/sane way of determining the number.
976 *
977 * @param key  the key whose number of subkeys is desired
978 *
979 * @return Returns the number of subkeys referenced by this key.
980 *
981 * @ingroup regfiBase
982 */
983_EXPORT
984uint32_t regfi_fetch_num_subkeys(const REGFI_NK* key);
985
986
987/** Retrieves number of values referenced by this key.
988 *
989 * Number of values in key structure and value list structure could differ,
990 * so this provides a standard/sane way of determining the number.
991 *
992 * @param key  the key whose number of values is desired
993 *
994 * @return Returns the number of values referenced by this key.
995 *
996 * @ingroup regfiBase
997 */
998_EXPORT
999uint32_t regfi_fetch_num_values(const REGFI_NK* key);
1000
1001
1002/** Retrieves classname for a given key.
1003 *
1004 * @param file the file from which key is derived
1005 * @param key the key whose classname is desired
1006 *
1007 * @return Returns a newly allocated classname structure, or NULL on failure.
1008 *         Classname structures must be freed with @ref regfi_free_record.
1009 *
1010 * @ingroup regfiBase
1011 */
1012_EXPORT
1013const REGFI_CLASSNAME* regfi_fetch_classname(REGFI_FILE* file, 
1014                                             const REGFI_NK* key);
1015
1016
1017/** Returns the SK (security) record referenced by the supplied key.
1018 *
1019 * @param file the file from which key is derived
1020 * @param key  the key whose SK record is desired
1021 *
1022 * @return A read-only SK structure, or NULL on failure.
1023 *
1024 * @ingroup regfiBase
1025 */
1026_EXPORT
1027const REGFI_SK* regfi_fetch_sk(REGFI_FILE* file, const REGFI_NK* key);
1028
1029
1030/** Retrieves data for a given value.
1031 *
1032 * @param file the file from which value is derived
1033 * @param value the value whose data is desired
1034 *
1035 * @return Returns a newly allocated data structure, or NULL on failure.
1036 *         Data structures must be freed with @ref regfi_free_record.
1037 *
1038 * @ingroup regfiBase
1039 */
1040_EXPORT
1041const REGFI_DATA* regfi_fetch_data(REGFI_FILE* file,
1042                                   const REGFI_VK* value);
1043
1044
1045/** Locates a specific subkey of a given key.
1046 *
1047 * @param file  the file from which key is derived
1048 * @param key   the key whose subkey is desired
1049 * @param name  name of the desired subkey
1050 * @param index a return value: the index of the desired subkey.
1051 *              undefined on error
1052 *
1053 * @return true if the subkey is found, false if an error occurred or if the
1054 *         specified name could not be found. If an error occurs, messages
1055 *         will be written explaining the issue. (See regfi_log_get_str.)
1056 *
1057 * @ingroup regfiBase
1058 */
1059_EXPORT
1060bool regfi_find_subkey(REGFI_FILE* file, const REGFI_NK* key, 
1061                       const char* name, uint32_t* index);
1062
1063
1064/** Locates a specific value of a given key.
1065 *
1066 * @param file  the file from which key is derived
1067 * @param key   the key whose value is desired
1068 * @param name  name of the desired value
1069 * @param index a return value: the index of the desired value. 
1070 *              undefined on error
1071 *
1072 * @return true if the value is found, false if an error occurred or if the
1073 *         specified name could not be found. If an error occurs, messages
1074 *         will be written explaining the issue. (See regfi_log_get_str.)
1075 *
1076 * @ingroup regfiBase
1077 */
1078_EXPORT
1079bool regfi_find_value(REGFI_FILE* file, const REGFI_NK* key,
1080                      const char* name, uint32_t* index);
1081
1082
1083/** Retrieves a specific subkey of a given key.
1084 *
1085 * @param file  the file from which key is derived
1086 * @param key   the key whose subkey is desired
1087 * @param index the index of the desired subkey
1088 *
1089 * @return the requested subkey or NULL on error.
1090 *
1091 * @ingroup regfiBase
1092 */
1093_EXPORT
1094const REGFI_NK* regfi_get_subkey(REGFI_FILE* file, const REGFI_NK* key, 
1095                                 uint32_t index);
1096
1097
1098/** Retrieves a specific value of a given key.
1099 *
1100 * @param file  the file from which key is derived
1101 * @param key   the key whose value is desired
1102 * @param index the index of the desired value
1103 *
1104 * @return the requested value or NULL on error.
1105 *
1106 * @ingroup regfiBase
1107 */
1108_EXPORT
1109const REGFI_VK* regfi_get_value(REGFI_FILE* file, const REGFI_NK* key, 
1110                                uint32_t index);
1111
1112
1113
1114/******************************************************************************/
1115/**
1116 * @defgroup regfiIteratorLayer Iterator Layer: Primary regfi Library Interface
1117 *
1118 * This top layer of API functions provides an iterator interface which makes
1119 * traversing registry data structures easy in both single-threaded and
1120 * multi-threaded scenarios.
1121 */
1122/******************************************************************************/
1123
1124/** Creates a new iterator for the provided registry file.
1125 *
1126 * @param file The opened registry file the iterator should be created for.
1127 *
1128 * @param output_encoding Character encoding that strings should be returned in.
1129 *                        Only supply the REGFI_ENCODING_* constants, as others
1130 *                        will be rejected.
1131 *                        The following values are currently accepted:
1132 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
1133 *                        REGFI_ENCODING_ASCII
1134 *                        REGFI_ENCODING_UTF8
1135 *
1136 * @return A newly allocated REGFI_ITERATOR.
1137 *         Must be free()d with regfi_iterator_free.
1138 *
1139 * @ingroup regfiIteratorLayer
1140 */
1141_EXPORT
1142REGFI_ITERATOR* regfi_iterator_new(REGFI_FILE* file);
1143
1144
1145/** Frees a registry file iterator previously created by regfi_iterator_new.
1146 *
1147 * This does not affect the underlying registry file's allocation status.
1148 *
1149 * @param i the iterator to be freed
1150 *
1151 * @ingroup regfiIteratorLayer
1152 */
1153_EXPORT
1154void regfi_iterator_free(REGFI_ITERATOR* i);
1155
1156
1157/** Traverse deeper into the registry tree at the current subkey.
1158 *
1159 * @param i the iterator
1160 *
1161 * @return  true on success, false on failure. 
1162 *          Note that subkey and value indexes are preserved.  That is, if a
1163 *          regfi_iterator_up call occurs later (reversing the effect of this
1164 *          call) then the subkey and value referenced prior to the
1165 *          regfi_iterator_down call will still be referenced.  This  makes
1166 *          depth-first iteration particularly easy.
1167 *
1168 * @ingroup regfiIteratorLayer
1169 */
1170_EXPORT
1171bool regfi_iterator_down(REGFI_ITERATOR* i);
1172
1173
1174/** Traverse up to the current key's parent key.
1175 *
1176 * @param i the iterator
1177 *
1178 * @return  true on success, false on failure.  Any subkey or value state
1179 *          associated with the current key is lost.
1180 *
1181 * @ingroup regfiIteratorLayer
1182 */
1183_EXPORT
1184bool regfi_iterator_up(REGFI_ITERATOR* i);
1185
1186
1187/** Traverse up to the root key of the hive.
1188 *
1189 * @param i the iterator
1190 *
1191 * @return true on success, false on failure.
1192 *
1193 * @ingroup regfiIteratorLayer
1194 */
1195_EXPORT
1196bool regfi_iterator_to_root(REGFI_ITERATOR* i);
1197
1198
1199/** Traverse down multiple levels in the registry hive.
1200 *
1201 * XXX: This currently only accepts ASCII key names.  Need to look into
1202 *      accepting other encodings.
1203 *
1204 * @param i    the iterator
1205 * @param path a list of key names representing the path.  This list must
1206 *             contain NUL terminated strings.  The list itself is
1207 *             terminated with a NULL pointer.  All path elements must be
1208 *             keys; value names are not accepted (even as the last
1209 *             element).
1210 *
1211 * @return true on success, false on failure.  If any element of path is not
1212 *                 found, false will be returned and the iterator will remain
1213 *                 in its original position.
1214 *
1215 * @ingroup regfiIteratorLayer
1216 */
1217_EXPORT
1218bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
1219
1220
1221/** Returns the currently referenced key.
1222 *
1223 * @param i the iterator
1224 *
1225 * @return A read-only key structure for the current key, or NULL on failure.
1226 *
1227 * @ingroup regfiIteratorLayer
1228 */
1229_EXPORT
1230const REGFI_NK* regfi_iterator_cur_key(REGFI_ITERATOR* i);
1231
1232
1233/** Sets the internal subkey index to the first subkey referenced by the current
1234 *  key.
1235 *
1236 * @param i the iterator
1237 *
1238 * @return True if the current key has any subkeys, false otherwise.
1239 *
1240 * @ingroup regfiIteratorLayer
1241 */
1242_EXPORT
1243bool regfi_iterator_first_subkey(REGFI_ITERATOR* i);
1244
1245
1246/** Returns the currently indexed subkey.
1247 *
1248 * @param i the iterator
1249 *
1250 * @return A newly allocated key structure for the currently referenced subkey,
1251 *         or NULL on failure.  Newly allocated keys must be freed with
1252 *         @ref regfi_free_record.
1253 *
1254 * @ingroup regfiIteratorLayer
1255 */
1256_EXPORT
1257const REGFI_NK* regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
1258
1259
1260/** Increments the internal subkey index to the next key in the subkey-list.
1261 *
1262 * @param i the iterator
1263 *
1264 * @return True if another subkey should exist, false otherwise.
1265 *
1266 * @ingroup regfiIteratorLayer
1267 */
1268_EXPORT
1269bool regfi_iterator_next_subkey(REGFI_ITERATOR* i);
1270
1271
1272/** Searches for a subkey with a given name under the current key.
1273 *
1274 * @param i     the iterator
1275 * @param name  subkey name to search for
1276 *
1277 * @return True if such a subkey was found, false otherwise.  If a subkey is
1278 *         found, the current subkey index is set to that subkey.  Otherwise,
1279 *         the subkey index remains at the same location as before the call.
1280 *
1281 * @ingroup regfiIteratorLayer
1282 */
1283_EXPORT
1284bool regfi_iterator_find_subkey(REGFI_ITERATOR* i, const char* name);
1285
1286
1287/** Sets the internal value index to the first value referenced by the current
1288 *  key.
1289 *
1290 * @param i the iterator
1291 *
1292 * @return True if the current key has any values, false otherwise.
1293 *
1294 * @ingroup regfiIteratorLayer
1295 */
1296_EXPORT
1297bool regfi_iterator_first_value(REGFI_ITERATOR* i);
1298
1299
1300/** Returns the currently indexed value.
1301 *
1302 * @param i the iterator
1303 *
1304 * @return A newly allocated value structure for the currently referenced value,
1305 *         or NULL on failure.  Newly allocated values must be freed with
1306 *         @ref regfi_free_record.
1307 *
1308 * @ingroup regfiIteratorLayer
1309 */
1310_EXPORT
1311const REGFI_VK* regfi_iterator_cur_value(REGFI_ITERATOR* i);
1312
1313
1314/** Increments the internal value index to the next value in the value-list.
1315 *
1316 * @param i the iterator
1317 *
1318 * @return True if another value should exist, false otherwise.
1319 *
1320 * @ingroup regfiIteratorLayer
1321 */
1322_EXPORT
1323bool regfi_iterator_next_value(REGFI_ITERATOR* i);
1324
1325
1326/** Searches for a value with a given name under the current key.
1327 *
1328 * @param i     the iterator
1329 * @param name  value name to search for
1330 *
1331 * @return True if such a value was found, false otherwise.  If a value is
1332 *         found, the current value index is set to that value.  Otherwise,
1333 *         the value index remains at the same location as before the call.
1334 *
1335 * @ingroup regfiIteratorLayer
1336 */
1337_EXPORT
1338bool regfi_iterator_find_value(REGFI_ITERATOR* i, const char* name);
1339
1340
1341/******************************************************************************/
1342/**
1343 * @defgroup regfiGlueLayer Glue Layer: Logical Data Structure Loading
1344 */
1345/******************************************************************************/
1346
1347/** Loads a key at a given file offset along with associated data structures.
1348 *
1349 * XXX: finish documenting
1350 *
1351 * @ingroup regfiGlueLayer
1352 */
1353_EXPORT
1354REGFI_NK* regfi_load_key(REGFI_FILE* file, uint32_t offset, 
1355                             REGFI_ENCODING output_encoding, 
1356                             bool strict);
1357
1358
1359/** Loads a value at a given file offset alng with associated data structures.
1360 *
1361 * XXX: finish documenting
1362 *
1363 * @ingroup regfiGlueLayer
1364 */
1365_EXPORT
1366REGFI_VK* regfi_load_value(REGFI_FILE* file, uint32_t offset, 
1367                               REGFI_ENCODING output_encoding, 
1368                               bool strict);
1369
1370
1371/** Loads a logical subkey list in its entirety which may span multiple records.
1372 *
1373 * XXX: finish documenting
1374 *
1375 * @ingroup regfiGlueLayer
1376 */
1377_EXPORT
1378REGFI_SUBKEY_LIST* regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
1379                                         uint32_t num_keys, uint32_t max_size,
1380                                         bool strict);
1381
1382
1383/** Loads a valuelist.
1384 *
1385 * XXX: finish documenting
1386 *
1387 * @ingroup regfiGlueLayer
1388 */
1389_EXPORT
1390REGFI_VALUE_LIST* regfi_load_valuelist(REGFI_FILE* file, uint32_t offset, 
1391                                       uint32_t num_values, uint32_t max_size,
1392                                       bool strict);
1393
1394
1395/** Loads a data record which may be contained in the virtual offset, in a
1396 *  single cell, or in multiple cells through big data records.
1397 *
1398 * XXX: finish documenting
1399 *
1400 * @ingroup regfiGlueLayer
1401 */
1402_EXPORT
1403REGFI_BUFFER regfi_load_data(REGFI_FILE* file, uint32_t voffset,
1404                             uint32_t length, bool data_in_offset,
1405                             bool strict);
1406
1407
1408/** Loads the data associated with a big data record at the specified offset.
1409 *
1410 * XXX: finish documenting
1411 *
1412 * @ingroup regfiGlueLayer
1413 */
1414_EXPORT
1415REGFI_BUFFER regfi_load_big_data(REGFI_FILE* file, uint32_t offset, 
1416                                 uint32_t data_length,uint32_t cell_length,
1417                                 range_list* used_ranges,
1418                                 bool strict);
1419
1420
1421/** Given raw data, attempts to interpret the data based on a specified registry
1422 *  data type.
1423 *
1424 * XXX: finish documenting
1425 *
1426 * @ingroup regfiGlueLayer
1427 */
1428_EXPORT
1429bool regfi_interpret_data(REGFI_FILE* file, 
1430                          REGFI_ENCODING string_encoding,
1431                          uint32_t type, REGFI_DATA* data);
1432
1433
1434
1435/* These are cached so return values don't need to be freed. */
1436
1437/** Loads an "sk" security record at the specified offset.
1438 *
1439 * XXX: finish documenting
1440 *
1441 * @ingroup regfiGlueLayer
1442 */
1443_EXPORT
1444const REGFI_SK* regfi_load_sk(REGFI_FILE* file, uint32_t offset,
1445                                  bool strict);
1446
1447
1448
1449
1450/** Retrieves the HBIN data structure stored at the specified offset.
1451 *
1452 * XXX: finish documenting
1453 *
1454 * @ingroup regfiGlueLayer
1455 */
1456_EXPORT
1457const REGFI_HBIN* regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
1458
1459
1460
1461/******************************************************************************/
1462/**
1463 * @defgroup regfiParseLayer Parsing Layer: Direct Data Structure Access
1464 */
1465/******************************************************************************/
1466
1467_EXPORT
1468REGFI_FILE* regfi_parse_regf(REGFI_RAW_FILE* file_cb, bool strict);
1469
1470_EXPORT
1471REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32_t offset, 
1472                             bool strict);
1473
1474
1475/** Parses an NK record at the specified offset
1476 *
1477 * @param file     the registry file structure
1478 * @param offset   the offset of the cell (not the record) to be parsed.
1479 * @param max_size the maximum size the NK cell could be. (for validation)
1480 * @param strict   if true, rejects any malformed records.  Otherwise,
1481 *                 tries to minimally validate integrity.
1482 *
1483 * @return A newly allocated NK record structure, or NULL on failure.
1484 *
1485 * @ingroup regfiParseLayer
1486 */
1487_EXPORT
1488REGFI_NK* regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
1489                             uint32_t max_size, bool strict);
1490
1491
1492/** Parses a single cell containing a subkey-list record.
1493 *
1494 * XXX: finish documenting
1495 *
1496 * @ingroup regfiParseLayer
1497 */
1498_EXPORT
1499REGFI_SUBKEY_LIST* regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
1500                                          uint32_t max_size, bool strict);
1501
1502
1503/** Parses a VK (value) record at the specified offset
1504 *
1505 * XXX: finish documenting
1506 *
1507 * @ingroup regfiParseLayer
1508 */
1509_EXPORT
1510REGFI_VK* regfi_parse_vk(REGFI_FILE* file, uint32_t offset, 
1511                             uint32_t max_size, bool strict);
1512
1513
1514/** Parses an SK (security) record at the specified offset
1515 *
1516 * XXX: finish documenting
1517 *
1518 * @ingroup regfiParseLayer
1519 */
1520_EXPORT
1521REGFI_SK* regfi_parse_sk(REGFI_FILE* file, uint32_t offset, 
1522                             uint32_t max_size, bool strict);
1523
1524
1525/** Retrieves information on all cells in the registry hive which are
1526 *  currently in the unallocated status. 
1527 *
1528 * The unallocated status is determined based soley on the cell length sign.
1529 *
1530 * XXX: finish documenting
1531 *
1532 * @ingroup regfiParseLayer
1533 */
1534_EXPORT
1535range_list* regfi_parse_unalloc_cells(REGFI_FILE* file);
1536
1537
1538/** Helper function to parse a cell
1539 *
1540 * XXX: finish documenting
1541 *
1542 * @ingroup regfiParseLayer
1543 */
1544_EXPORT
1545bool regfi_parse_cell(REGFI_RAW_FILE* file_cb, uint32_t offset,
1546                      uint8_t* hdr, uint32_t hdr_len,
1547                      uint32_t* cell_length, bool* unalloc);
1548
1549
1550/** Parses a classname cell
1551 *
1552 * XXX: finish documenting
1553 *
1554 * @ingroup regfiParseLayer
1555 */
1556_EXPORT
1557uint8_t* regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
1558                               uint16_t* name_length, 
1559                               uint32_t max_size, bool strict);
1560
1561
1562/** Parses a single-cell data record
1563 *
1564 * XXX: finish documenting
1565 *
1566 * @ingroup regfiParseLayer
1567 */
1568_EXPORT
1569REGFI_BUFFER regfi_parse_data(REGFI_FILE* file, uint32_t offset,
1570                              uint32_t length, bool strict);
1571
1572
1573/** Parses a "little data" record which is stored entirely within the
1574 *  provided virtual offset.
1575 *
1576 * XXX: finish documenting
1577 *
1578 * @ingroup regfiParseLayer
1579 */
1580_EXPORT
1581REGFI_BUFFER regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset, 
1582                                     uint32_t length, bool strict);
1583
1584
1585/******************************************************************************/
1586/*    Private Functions                                                       */
1587/******************************************************************************/
1588REGFI_NK*             regfi_rootkey(REGFI_FILE* file);
1589
1590off_t                 regfi_raw_seek(REGFI_RAW_FILE* self, 
1591                                     off_t offset, int whence);
1592ssize_t               regfi_raw_read(REGFI_RAW_FILE* self, 
1593                                     void* buf, size_t count);
1594_EXPORT
1595off_t                 regfi_seek(REGFI_RAW_FILE* file_cb, 
1596                                 off_t offset, int whence);
1597_EXPORT
1598uint32_t              regfi_read(REGFI_RAW_FILE* file_cb, 
1599                                 uint8_t* buf, uint32_t* length);
1600
1601_EXPORT
1602const char*           regfi_type_val2str(unsigned int val);
1603_EXPORT
1604int                   regfi_type_str2val(const char* str);
1605
1606_EXPORT
1607char*                 regfi_get_sacl(WINSEC_DESC* sec_desc);
1608_EXPORT
1609char*                 regfi_get_dacl(WINSEC_DESC* sec_desc);
1610_EXPORT
1611char*                 regfi_get_owner(WINSEC_DESC* sec_desc);
1612_EXPORT
1613char*                 regfi_get_group(WINSEC_DESC* sec_desc);
1614
1615REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists, 
1616                                              REGFI_SUBKEY_LIST** lists,
1617                                              bool strict);
1618REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1619                                                uint32_t max_size, bool strict,
1620                                                uint8_t depth_left);
1621void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type, 
1622                                        const char* fmt, ...);
1623REGFI_NK*             regfi_copy_nk(const REGFI_NK* nk);
1624REGFI_VK*             regfi_copy_vk(const REGFI_VK* vk);
1625_EXPORT
1626int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1627int32_t               regfi_conv_charset(const char* input_charset, 
1628                                         const char* output_charset,
1629                                         uint8_t* input, char* output, 
1630                                         uint32_t input_len, uint32_t output_max);
1631_EXPORT
1632REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
1633
1634/* XXX: move to base API and document */
1635_EXPORT
1636void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
1637_EXPORT
1638time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
1639
1640
1641_EXPORT
1642void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK* nk, 
1643                             REGFI_ENCODING output_encoding, bool strict);
1644_EXPORT
1645void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK* vk, 
1646                               REGFI_ENCODING output_encoding, bool strict);
1647
1648_EXPORT
1649void regfi_init();
1650
1651
1652#endif  /* _REGFI_H */
Note: See TracBrowser for help on using the repository browser.