[30] | 1 | /* |
---|
| 2 | * Branched from Samba project, Subversion repository version #6903: |
---|
| 3 | * http://websvn.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h |
---|
| 4 | * |
---|
| 5 | * Unix SMB/CIFS implementation. |
---|
| 6 | * Windows NT registry I/O library |
---|
| 7 | * |
---|
[61] | 8 | * Copyright (C) 2005-2006 Timothy D. Morgan |
---|
[30] | 9 | * Copyright (C) 2005 Gerald (Jerry) Carter |
---|
| 10 | * |
---|
| 11 | * This program is free software; you can redistribute it and/or modify |
---|
| 12 | * it under the terms of the GNU General Public License as published by |
---|
| 13 | * the Free Software Foundation; version 2 of the License. |
---|
| 14 | * |
---|
| 15 | * This program is distributed in the hope that it will be useful, |
---|
| 16 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 17 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 18 | * GNU General Public License for more details. |
---|
| 19 | * |
---|
| 20 | * You should have received a copy of the GNU General Public License |
---|
| 21 | * along with this program; if not, write to the Free Software |
---|
| 22 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
| 23 | * |
---|
| 24 | * $Id: regfio.h 77 2007-01-07 15:19:43Z tim $ |
---|
| 25 | */ |
---|
| 26 | |
---|
| 27 | /************************************************************ |
---|
| 28 | * Most of this information was obtained from |
---|
| 29 | * http://www.wednesday.demon.co.uk/dosreg.html |
---|
| 30 | * Thanks Nigel! |
---|
| 31 | ***********************************************************/ |
---|
| 32 | |
---|
| 33 | #ifndef _REGFIO_H |
---|
| 34 | #define _REGFIO_H |
---|
| 35 | |
---|
[31] | 36 | #include <stdlib.h> |
---|
| 37 | #include <stdio.h> |
---|
[30] | 38 | #include <stdbool.h> |
---|
[31] | 39 | #include <string.h> |
---|
[30] | 40 | #include <errno.h> |
---|
[31] | 41 | #include <time.h> |
---|
[30] | 42 | #include <fcntl.h> |
---|
| 43 | #include <sys/stat.h> |
---|
| 44 | #include <sys/types.h> |
---|
| 45 | #include <unistd.h> |
---|
| 46 | #include <assert.h> |
---|
| 47 | |
---|
| 48 | #include "smb_deps.h" |
---|
| 49 | |
---|
| 50 | /******************************************************************************/ |
---|
| 51 | /* Macros */ |
---|
| 52 | |
---|
[32] | 53 | /* Registry data types */ |
---|
| 54 | #define REG_NONE 0 |
---|
| 55 | #define REG_SZ 1 |
---|
| 56 | #define REG_EXPAND_SZ 2 |
---|
| 57 | #define REG_BINARY 3 |
---|
| 58 | #define REG_DWORD 4 |
---|
[54] | 59 | #define REG_DWORD_LE 4 /* DWORD, little endian */ |
---|
| 60 | #define REG_DWORD_BE 5 /* DWORD, big endian */ |
---|
[32] | 61 | #define REG_LINK 6 |
---|
| 62 | #define REG_MULTI_SZ 7 |
---|
| 63 | #define REG_RESOURCE_LIST 8 |
---|
| 64 | #define REG_FULL_RESOURCE_DESCRIPTOR 9 |
---|
| 65 | #define REG_RESOURCE_REQUIREMENTS_LIST 10 |
---|
[72] | 66 | #define REG_QWORD 11 /* 64-bit little endian */ |
---|
| 67 | /* XXX: Has MS defined a REG_QWORD_BE? */ |
---|
[32] | 68 | /* Not a real type in the registry */ |
---|
| 69 | #define REG_KEY 255 |
---|
| 70 | |
---|
| 71 | |
---|
[30] | 72 | #define REGF_BLOCKSIZE 0x1000 |
---|
| 73 | #define REGF_ALLOC_BLOCK 0x1000 |
---|
| 74 | |
---|
| 75 | /* header sizes for various records */ |
---|
| 76 | |
---|
| 77 | #define REGF_HDR_SIZE 4 |
---|
| 78 | #define HBIN_HDR_SIZE 4 |
---|
| 79 | #define HBIN_HEADER_REC_SIZE 0x24 |
---|
| 80 | #define REC_HDR_SIZE 2 |
---|
| 81 | |
---|
| 82 | #define REGF_OFFSET_NONE 0xffffffff |
---|
| 83 | |
---|
| 84 | /* Flags for the vk records */ |
---|
| 85 | |
---|
| 86 | #define VK_FLAG_NAME_PRESENT 0x0001 |
---|
| 87 | #define VK_DATA_IN_OFFSET 0x80000000 |
---|
[77] | 88 | #define VK_MAX_DATA_LENGTH 1024*1024 |
---|
[30] | 89 | |
---|
| 90 | /* NK record macros */ |
---|
| 91 | |
---|
| 92 | #define NK_TYPE_LINKKEY 0x0010 |
---|
| 93 | #define NK_TYPE_NORMALKEY 0x0020 |
---|
| 94 | #define NK_TYPE_ROOTKEY 0x002c |
---|
| 95 | |
---|
[54] | 96 | #define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ }; |
---|
| 97 | /* if the count == 0; we can clean up */ |
---|
| 98 | #define HBIN_REMOVE_REF(x, y){ x->hbin = NULL; y->ref_count-- }; |
---|
[30] | 99 | |
---|
| 100 | |
---|
| 101 | /* HBIN block */ |
---|
| 102 | struct regf_hbin; |
---|
| 103 | typedef struct regf_hbin { |
---|
[53] | 104 | struct regf_hbin* prev; |
---|
| 105 | struct regf_hbin* next; |
---|
| 106 | uint32 file_off; /* my offset in the registry file */ |
---|
| 107 | uint32 free_off; /* offset to free space within the hbin record */ |
---|
| 108 | uint32 free_size; /* amount of data left in the block */ |
---|
[54] | 109 | int ref_count; /* how many active records are pointing to this |
---|
| 110 | * block (not used currently) |
---|
| 111 | */ |
---|
[30] | 112 | |
---|
[53] | 113 | uint8 header[HBIN_HDR_SIZE]; /* "hbin" */ |
---|
| 114 | uint32 first_hbin_off; /* offset from first hbin block */ |
---|
[54] | 115 | uint32 block_size; /* block size of this block is |
---|
| 116 | * usually a multiple of 4096Kb |
---|
| 117 | */ |
---|
| 118 | prs_struct ps; /* data */ |
---|
[53] | 119 | bool dirty; /* has this hbin block been modified? */ |
---|
[30] | 120 | } REGF_HBIN; |
---|
| 121 | |
---|
| 122 | /* ??? List -- list of key offsets and hashed names for consistency */ |
---|
| 123 | typedef struct { |
---|
[53] | 124 | uint32 nk_off; |
---|
| 125 | uint8 keycheck[sizeof(uint32)]; |
---|
[30] | 126 | } REGF_HASH_REC; |
---|
| 127 | |
---|
| 128 | typedef struct { |
---|
[54] | 129 | REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing |
---|
| 130 | * this nk record |
---|
| 131 | */ |
---|
| 132 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 133 | uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
[53] | 134 | |
---|
| 135 | uint8 header[REC_HDR_SIZE]; |
---|
| 136 | uint16 num_keys; |
---|
| 137 | REGF_HASH_REC *hashes; |
---|
[30] | 138 | } REGF_LF_REC; |
---|
| 139 | |
---|
| 140 | /* Key Value */ |
---|
| 141 | |
---|
| 142 | typedef struct { |
---|
[54] | 143 | REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing |
---|
| 144 | * this nk record |
---|
| 145 | */ |
---|
[53] | 146 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 147 | uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
[54] | 148 | uint32 rec_off; /* offset stored in the value list */ |
---|
[53] | 149 | |
---|
| 150 | uint8 header[REC_HDR_SIZE]; |
---|
| 151 | char* valuename; |
---|
| 152 | uint32 data_size; |
---|
| 153 | uint32 data_off; |
---|
| 154 | uint8* data; |
---|
| 155 | uint32 type; |
---|
| 156 | uint16 flag; |
---|
[30] | 157 | } REGF_VK_REC; |
---|
| 158 | |
---|
| 159 | |
---|
| 160 | /* Key Security */ |
---|
| 161 | struct _regf_sk_rec; |
---|
| 162 | |
---|
| 163 | typedef struct _regf_sk_rec { |
---|
[53] | 164 | struct _regf_sk_rec *next, *prev; |
---|
[54] | 165 | REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing |
---|
| 166 | * this nk record |
---|
| 167 | */ |
---|
[53] | 168 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 169 | uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 170 | |
---|
[54] | 171 | uint32 sk_off; /* offset parsed from NK record used as a key |
---|
| 172 | * to lookup reference to this SK record |
---|
| 173 | */ |
---|
[53] | 174 | |
---|
| 175 | uint8 header[REC_HDR_SIZE]; |
---|
| 176 | uint32 prev_sk_off; |
---|
| 177 | uint32 next_sk_off; |
---|
| 178 | uint32 ref_count; |
---|
| 179 | uint32 size; |
---|
| 180 | SEC_DESC *sec_desc; |
---|
[30] | 181 | } REGF_SK_REC; |
---|
| 182 | |
---|
| 183 | /* Key Name */ |
---|
| 184 | |
---|
| 185 | typedef struct { |
---|
[54] | 186 | REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing |
---|
| 187 | * this nk record |
---|
| 188 | */ |
---|
[53] | 189 | uint32 hbin_off; /* offset from beginning of this hbin block */ |
---|
| 190 | uint32 subkey_index; /* index to next subkey record to return */ |
---|
| 191 | uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ |
---|
| 192 | |
---|
| 193 | /* header information */ |
---|
| 194 | uint8 header[REC_HDR_SIZE]; |
---|
| 195 | uint16 key_type; |
---|
| 196 | NTTIME mtime; |
---|
| 197 | uint32 parent_off; /* back pointer in registry hive */ |
---|
| 198 | uint32 classname_off; |
---|
| 199 | char *classname; |
---|
| 200 | char *keyname; |
---|
| 201 | |
---|
| 202 | /* max lengths */ |
---|
[54] | 203 | uint32 max_bytes_subkeyname; /* max subkey name * 2 */ |
---|
| 204 | uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */ |
---|
| 205 | uint32 max_bytes_valuename; /* max valuename * 2 */ |
---|
| 206 | uint32 max_bytes_value; /* max value data size */ |
---|
[53] | 207 | |
---|
| 208 | /* unknowns */ |
---|
[54] | 209 | uint32 unk_index; /* nigel says run time index ? */ |
---|
[53] | 210 | |
---|
| 211 | /* children */ |
---|
| 212 | uint32 num_subkeys; |
---|
| 213 | uint32 subkeys_off; /* hash records that point to NK records */ |
---|
| 214 | uint32 num_values; |
---|
| 215 | uint32 values_off; /* value lists which point to VK records */ |
---|
[54] | 216 | uint32 sk_off; /* offset to SK record */ |
---|
[53] | 217 | |
---|
| 218 | /* link in the other records here */ |
---|
| 219 | REGF_LF_REC subkeys; |
---|
| 220 | REGF_VK_REC *values; |
---|
| 221 | REGF_SK_REC *sec_desc; |
---|
[30] | 222 | |
---|
| 223 | } REGF_NK_REC; |
---|
| 224 | |
---|
| 225 | /* REGF block */ |
---|
| 226 | |
---|
| 227 | typedef struct { |
---|
[53] | 228 | /* run time information */ |
---|
[54] | 229 | int fd; /* file descriptor */ |
---|
| 230 | int open_flags; /* flags passed to the open() call */ |
---|
| 231 | void *mem_ctx; /* memory context for run-time file access information */ |
---|
| 232 | REGF_HBIN *block_list; /* list of open hbin blocks */ |
---|
[53] | 233 | |
---|
| 234 | /* file format information */ |
---|
| 235 | |
---|
| 236 | uint8 header[REGF_HDR_SIZE]; /* "regf" */ |
---|
[54] | 237 | uint32 data_offset; /* offset to record in the first (or any?) |
---|
| 238 | * hbin block |
---|
| 239 | */ |
---|
[53] | 240 | uint32 last_block; /* offset to last hbin block in file */ |
---|
| 241 | uint32 checksum; /* XOR of bytes 0x0000 - 0x01FB */ |
---|
| 242 | NTTIME mtime; |
---|
| 243 | |
---|
[54] | 244 | REGF_SK_REC *sec_desc_list; /* list of security descriptors referenced |
---|
| 245 | * by NK records |
---|
| 246 | */ |
---|
[53] | 247 | |
---|
| 248 | /* unknowns used to simply writing */ |
---|
| 249 | uint32 unknown1; |
---|
| 250 | uint32 unknown2; |
---|
| 251 | uint32 unknown3; |
---|
| 252 | uint32 unknown4; |
---|
| 253 | uint32 unknown5; |
---|
| 254 | uint32 unknown6; |
---|
| 255 | } REGF_FILE; |
---|
[30] | 256 | |
---|
| 257 | |
---|
[54] | 258 | /******************************************************************************/ |
---|
[30] | 259 | /* Function Declarations */ |
---|
[54] | 260 | |
---|
[41] | 261 | const char* regfio_type_val2str(unsigned int val); |
---|
| 262 | int regfio_type_str2val(const char* str); |
---|
[32] | 263 | |
---|
[53] | 264 | char* regfio_get_sacl(SEC_DESC *sec_desc); |
---|
| 265 | char* regfio_get_dacl(SEC_DESC *sec_desc); |
---|
| 266 | char* regfio_get_owner(SEC_DESC *sec_desc); |
---|
| 267 | char* regfio_get_group(SEC_DESC *sec_desc); |
---|
| 268 | |
---|
[30] | 269 | REGF_FILE* regfio_open( const char *filename ); |
---|
| 270 | int regfio_close( REGF_FILE *r ); |
---|
| 271 | |
---|
| 272 | REGF_NK_REC* regfio_rootkey( REGF_FILE *file ); |
---|
| 273 | REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk ); |
---|
| 274 | |
---|
| 275 | #endif /* _REGFIO_H */ |
---|