1 | /* |
---|
2 | * Branched from Samba project Subversion repository, version #7470: |
---|
3 | * http://websvn.samba.org/cgi-bin/viewcvs.cgi/trunk/source/registry/regfio.c |
---|
4 | * |
---|
5 | * Unix SMB/CIFS implementation. |
---|
6 | * Windows NT registry I/O library |
---|
7 | * |
---|
8 | * Copyright (C) 2005 Timothy D. Morgan |
---|
9 | * Copyright (C) 2005 Gerald (Jerry) Carter |
---|
10 | * |
---|
11 | * This program is free software; you can redistribute it and/or modify |
---|
12 | * it under the terms of the GNU General Public License as published by |
---|
13 | * the Free Software Foundation; version 2 of the License. |
---|
14 | * |
---|
15 | * This program is distributed in the hope that it will be useful, |
---|
16 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
17 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
18 | * GNU General Public License for more details. |
---|
19 | * |
---|
20 | * You should have received a copy of the GNU General Public License |
---|
21 | * along with this program; if not, write to the Free Software |
---|
22 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
23 | * |
---|
24 | * $Id: regfio.c 32 2005-07-16 23:16:17Z tim $ |
---|
25 | */ |
---|
26 | |
---|
27 | #include "../include/regfio.h" |
---|
28 | |
---|
29 | |
---|
30 | |
---|
31 | /******************************************************************* |
---|
32 | * |
---|
33 | * TODO : Right now this code basically ignores classnames. |
---|
34 | * |
---|
35 | ******************************************************************/ |
---|
36 | |
---|
37 | /* Registry types mapping */ |
---|
38 | const VAL_STR reg_type_names[] = |
---|
39 | { |
---|
40 | { REG_SZ, "SZ" }, |
---|
41 | { REG_EXPAND_SZ, "EXPAND_SZ" }, |
---|
42 | { REG_BINARY, "BIN" }, |
---|
43 | { REG_DWORD, "DWORD" }, |
---|
44 | { REG_DWORD_BE, "DWORD_BE" }, |
---|
45 | { REG_LINK, "LINK" }, |
---|
46 | { REG_MULTI_SZ, "MULTI_SZ" }, |
---|
47 | { REG_RESOURCE_LIST, "RSRC_LIST" }, |
---|
48 | { REG_FULL_RESOURCE_DESCRIPTOR, "RSRC_DESC" }, |
---|
49 | { REG_RESOURCE_REQUIREMENTS_LIST,"RSRC_REQ_LIST"}, |
---|
50 | { REG_KEY, "KEY" }, |
---|
51 | { 0, NULL }, |
---|
52 | }; |
---|
53 | |
---|
54 | |
---|
55 | /* Returns NULL on error */ |
---|
56 | const char* type_val2str(unsigned int val) |
---|
57 | { |
---|
58 | int i; |
---|
59 | |
---|
60 | for(i=0; reg_type_names[i].val && reg_type_names[i].str; i++) |
---|
61 | if (reg_type_names[i].val == val) |
---|
62 | return reg_type_names[i].str; |
---|
63 | |
---|
64 | return NULL; |
---|
65 | } |
---|
66 | |
---|
67 | |
---|
68 | /* Returns 0 on error */ |
---|
69 | int type_str2val(const char* str) |
---|
70 | { |
---|
71 | int i; |
---|
72 | |
---|
73 | for(i=0; reg_type_names[i].val && reg_type_names[i].str; i++) |
---|
74 | if (strcmp(reg_type_names[i].str, str) == 0) |
---|
75 | return reg_type_names[i].val; |
---|
76 | |
---|
77 | return 0; |
---|
78 | } |
---|
79 | |
---|
80 | |
---|
81 | /******************************************************************* |
---|
82 | *******************************************************************/ |
---|
83 | static int read_block( REGF_FILE *file, prs_struct *ps, uint32 file_offset, |
---|
84 | uint32 block_size ) |
---|
85 | { |
---|
86 | int bytes_read, returned; |
---|
87 | char *buffer; |
---|
88 | SMB_STRUCT_STAT sbuf; |
---|
89 | |
---|
90 | /* check for end of file */ |
---|
91 | |
---|
92 | if ( fstat( file->fd, &sbuf ) ) { |
---|
93 | /*DEBUG(0,("read_block: stat() failed! (%s)\n", strerror(errno)));*/ |
---|
94 | return -1; |
---|
95 | } |
---|
96 | |
---|
97 | if ( (size_t)file_offset >= sbuf.st_size ) |
---|
98 | return -1; |
---|
99 | |
---|
100 | /* if block_size == 0, we are parsnig HBIN records and need |
---|
101 | to read some of the header to get the block_size from there */ |
---|
102 | |
---|
103 | if ( block_size == 0 ) { |
---|
104 | uint8 hdr[0x20]; |
---|
105 | |
---|
106 | if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) { |
---|
107 | /*DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));*/ |
---|
108 | return -1; |
---|
109 | } |
---|
110 | |
---|
111 | returned = read( file->fd, hdr, 0x20 ); |
---|
112 | if ( (returned == -1) || (returned < 0x20) ) { |
---|
113 | /*DEBUG(0,("read_block: failed to read in HBIN header. Is the file corrupt?\n"));*/ |
---|
114 | return -1; |
---|
115 | } |
---|
116 | |
---|
117 | /* make sure this is an hbin header */ |
---|
118 | |
---|
119 | if ( strncmp( hdr, "hbin", HBIN_HDR_SIZE ) != 0 ) { |
---|
120 | /*DEBUG(0,("read_block: invalid block header!\n"));*/ |
---|
121 | return -1; |
---|
122 | } |
---|
123 | |
---|
124 | block_size = IVAL( hdr, 0x08 ); |
---|
125 | } |
---|
126 | |
---|
127 | /*DEBUG(10,("read_block: block_size == 0x%x\n", block_size ));*/ |
---|
128 | |
---|
129 | /* set the offset, initialize the buffer, and read the block from disk */ |
---|
130 | |
---|
131 | if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) { |
---|
132 | /*DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));*/ |
---|
133 | return -1; |
---|
134 | } |
---|
135 | |
---|
136 | prs_init( ps, block_size, file->mem_ctx, UNMARSHALL ); |
---|
137 | buffer = ps->data_p; |
---|
138 | bytes_read = returned = 0; |
---|
139 | |
---|
140 | while ( bytes_read < block_size ) |
---|
141 | { |
---|
142 | if((returned = |
---|
143 | read(file->fd, buffer+bytes_read, block_size-bytes_read)) == -1) |
---|
144 | { |
---|
145 | /*DEBUG(0,("read_block: read() failed (%s)\n", strerror(errno) ));*/ |
---|
146 | return false; |
---|
147 | } |
---|
148 | if ((returned == 0) && (bytes_read < block_size)) |
---|
149 | { |
---|
150 | /*DEBUG(0,("read_block: not a vald registry file ?\n" ));*/ |
---|
151 | return false; |
---|
152 | } |
---|
153 | |
---|
154 | bytes_read += returned; |
---|
155 | } |
---|
156 | |
---|
157 | return bytes_read; |
---|
158 | } |
---|
159 | |
---|
160 | |
---|
161 | /******************************************************************* |
---|
162 | *******************************************************************/ |
---|
163 | static bool prs_regf_block( const char *desc, prs_struct *ps, int depth, REGF_FILE *file ) |
---|
164 | { |
---|
165 | depth++; |
---|
166 | |
---|
167 | if ( !prs_uint8s( true, "header", ps, depth, file->header, sizeof( file->header )) ) |
---|
168 | return false; |
---|
169 | |
---|
170 | /* yes, these values are always identical so store them only once */ |
---|
171 | |
---|
172 | if ( !prs_uint32( "unknown1", ps, depth, &file->unknown1 )) |
---|
173 | return false; |
---|
174 | if ( !prs_uint32( "unknown1 (again)", ps, depth, &file->unknown1 )) |
---|
175 | return false; |
---|
176 | |
---|
177 | /* get the modtime */ |
---|
178 | |
---|
179 | if ( !prs_set_offset( ps, 0x0c ) ) |
---|
180 | return false; |
---|
181 | if ( !smb_io_time( "modtime", &file->mtime, ps, depth ) ) |
---|
182 | return false; |
---|
183 | |
---|
184 | /* constants */ |
---|
185 | |
---|
186 | if ( !prs_uint32( "unknown2", ps, depth, &file->unknown2 )) |
---|
187 | return false; |
---|
188 | if ( !prs_uint32( "unknown3", ps, depth, &file->unknown3 )) |
---|
189 | return false; |
---|
190 | if ( !prs_uint32( "unknown4", ps, depth, &file->unknown4 )) |
---|
191 | return false; |
---|
192 | if ( !prs_uint32( "unknown5", ps, depth, &file->unknown5 )) |
---|
193 | return false; |
---|
194 | |
---|
195 | /* get file offsets */ |
---|
196 | |
---|
197 | if ( !prs_set_offset( ps, 0x24 ) ) |
---|
198 | return false; |
---|
199 | if ( !prs_uint32( "data_offset", ps, depth, &file->data_offset )) |
---|
200 | return false; |
---|
201 | if ( !prs_uint32( "last_block", ps, depth, &file->last_block )) |
---|
202 | return false; |
---|
203 | |
---|
204 | /* one more constant */ |
---|
205 | |
---|
206 | if ( !prs_uint32( "unknown6", ps, depth, &file->unknown6 )) |
---|
207 | return false; |
---|
208 | |
---|
209 | /* get the checksum */ |
---|
210 | |
---|
211 | if ( !prs_set_offset( ps, 0x01fc ) ) |
---|
212 | return false; |
---|
213 | if ( !prs_uint32( "checksum", ps, depth, &file->checksum )) |
---|
214 | return false; |
---|
215 | |
---|
216 | return true; |
---|
217 | } |
---|
218 | |
---|
219 | |
---|
220 | /******************************************************************* |
---|
221 | *******************************************************************/ |
---|
222 | static bool prs_hbin_block( const char *desc, prs_struct *ps, int depth, REGF_HBIN *hbin ) |
---|
223 | { |
---|
224 | uint32 block_size2; |
---|
225 | |
---|
226 | depth++; |
---|
227 | |
---|
228 | if ( !prs_uint8s( true, "header", ps, depth, hbin->header, sizeof( hbin->header )) ) |
---|
229 | return false; |
---|
230 | |
---|
231 | if ( !prs_uint32( "first_hbin_off", ps, depth, &hbin->first_hbin_off )) |
---|
232 | return false; |
---|
233 | |
---|
234 | /* The dosreg.cpp comments say that the block size is at 0x1c. |
---|
235 | According to a WINXP NTUSER.dat file, this is wrong. The block_size |
---|
236 | is at 0x08 */ |
---|
237 | |
---|
238 | if ( !prs_uint32( "block_size", ps, depth, &hbin->block_size )) |
---|
239 | return false; |
---|
240 | |
---|
241 | block_size2 = hbin->block_size; |
---|
242 | prs_set_offset( ps, 0x1c ); |
---|
243 | if ( !prs_uint32( "block_size2", ps, depth, &block_size2 )) |
---|
244 | return false; |
---|
245 | |
---|
246 | if ( !ps->io ) |
---|
247 | hbin->dirty = true; |
---|
248 | |
---|
249 | |
---|
250 | return true; |
---|
251 | } |
---|
252 | |
---|
253 | |
---|
254 | /******************************************************************* |
---|
255 | *******************************************************************/ |
---|
256 | static bool prs_nk_rec( const char *desc, prs_struct *ps, int depth, REGF_NK_REC *nk ) |
---|
257 | { |
---|
258 | uint16 class_length, name_length; |
---|
259 | uint32 start; |
---|
260 | uint32 data_size, start_off, end_off; |
---|
261 | uint32 unknown_off = REGF_OFFSET_NONE; |
---|
262 | |
---|
263 | nk->hbin_off = ps->data_offset; |
---|
264 | start = nk->hbin_off; |
---|
265 | |
---|
266 | depth++; |
---|
267 | |
---|
268 | /* back up and get the data_size */ |
---|
269 | |
---|
270 | if ( !prs_set_offset( ps, ps->data_offset-sizeof(uint32)) ) |
---|
271 | return false; |
---|
272 | start_off = ps->data_offset; |
---|
273 | if ( !prs_uint32( "rec_size", ps, depth, &nk->rec_size )) |
---|
274 | return false; |
---|
275 | |
---|
276 | if ( !prs_uint8s( true, "header", ps, depth, nk->header, sizeof( nk->header )) ) |
---|
277 | return false; |
---|
278 | |
---|
279 | if ( !prs_uint16( "key_type", ps, depth, &nk->key_type )) |
---|
280 | return false; |
---|
281 | if ( !smb_io_time( "mtime", &nk->mtime, ps, depth )) |
---|
282 | return false; |
---|
283 | |
---|
284 | if ( !prs_set_offset( ps, start+0x0010 ) ) |
---|
285 | return false; |
---|
286 | if ( !prs_uint32( "parent_off", ps, depth, &nk->parent_off )) |
---|
287 | return false; |
---|
288 | if ( !prs_uint32( "num_subkeys", ps, depth, &nk->num_subkeys )) |
---|
289 | return false; |
---|
290 | |
---|
291 | if ( !prs_set_offset( ps, start+0x001c ) ) |
---|
292 | return false; |
---|
293 | if ( !prs_uint32( "subkeys_off", ps, depth, &nk->subkeys_off )) |
---|
294 | return false; |
---|
295 | if ( !prs_uint32( "unknown_off", ps, depth, &unknown_off) ) |
---|
296 | return false; |
---|
297 | |
---|
298 | if ( !prs_set_offset( ps, start+0x0024 ) ) |
---|
299 | return false; |
---|
300 | if ( !prs_uint32( "num_values", ps, depth, &nk->num_values )) |
---|
301 | return false; |
---|
302 | if ( !prs_uint32( "values_off", ps, depth, &nk->values_off )) |
---|
303 | return false; |
---|
304 | if ( !prs_uint32( "sk_off", ps, depth, &nk->sk_off )) |
---|
305 | return false; |
---|
306 | if ( !prs_uint32( "classname_off", ps, depth, &nk->classname_off )) |
---|
307 | return false; |
---|
308 | |
---|
309 | if ( !prs_uint32( "max_bytes_subkeyname", ps, depth, &nk->max_bytes_subkeyname)) |
---|
310 | return false; |
---|
311 | if ( !prs_uint32( "max_bytes_subkeyclassname", ps, depth, &nk->max_bytes_subkeyclassname)) |
---|
312 | return false; |
---|
313 | if ( !prs_uint32( "max_bytes_valuename", ps, depth, &nk->max_bytes_valuename)) |
---|
314 | return false; |
---|
315 | if ( !prs_uint32( "max_bytes_value", ps, depth, &nk->max_bytes_value)) |
---|
316 | return false; |
---|
317 | if ( !prs_uint32( "unknown index", ps, depth, &nk->unk_index)) |
---|
318 | return false; |
---|
319 | |
---|
320 | name_length = nk->keyname ? strlen(nk->keyname) : 0 ; |
---|
321 | class_length = nk->classname ? strlen(nk->classname) : 0 ; |
---|
322 | if ( !prs_uint16( "name_length", ps, depth, &name_length )) |
---|
323 | return false; |
---|
324 | if ( !prs_uint16( "class_length", ps, depth, &class_length )) |
---|
325 | return false; |
---|
326 | |
---|
327 | if ( class_length ) { |
---|
328 | ;; |
---|
329 | } |
---|
330 | |
---|
331 | if ( name_length ) { |
---|
332 | if ( ps->io ) { |
---|
333 | if ( !(nk->keyname = (char*)zcalloc(sizeof(char), name_length+1 )) ) |
---|
334 | return false; |
---|
335 | } |
---|
336 | |
---|
337 | if ( !prs_uint8s( true, "name", ps, depth, nk->keyname, name_length) ) |
---|
338 | return false; |
---|
339 | |
---|
340 | if ( ps->io ) |
---|
341 | nk->keyname[name_length] = '\0'; |
---|
342 | } |
---|
343 | |
---|
344 | end_off = ps->data_offset; |
---|
345 | |
---|
346 | /* data_size must be divisible by 8 and large enough to hold the original record */ |
---|
347 | |
---|
348 | data_size = ((start_off - end_off) & 0xfffffff8 ); |
---|
349 | if ( data_size > nk->rec_size ) |
---|
350 | /*DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, nk->rec_size));*/ |
---|
351 | |
---|
352 | if ( !ps->io ) |
---|
353 | nk->hbin->dirty = true; |
---|
354 | |
---|
355 | return true; |
---|
356 | } |
---|
357 | |
---|
358 | |
---|
359 | /******************************************************************* |
---|
360 | *******************************************************************/ |
---|
361 | static uint32 regf_block_checksum( prs_struct *ps ) |
---|
362 | { |
---|
363 | char *buffer = ps->data_p; |
---|
364 | uint32 checksum, x; |
---|
365 | int i; |
---|
366 | |
---|
367 | /* XOR of all bytes 0x0000 - 0x01FB */ |
---|
368 | |
---|
369 | checksum = x = 0; |
---|
370 | |
---|
371 | for ( i=0; i<0x01FB; i+=4 ) { |
---|
372 | x = IVAL(buffer, i ); |
---|
373 | checksum ^= x; |
---|
374 | } |
---|
375 | |
---|
376 | return checksum; |
---|
377 | } |
---|
378 | |
---|
379 | |
---|
380 | /******************************************************************* |
---|
381 | *******************************************************************/ |
---|
382 | static bool read_regf_block( REGF_FILE *file ) |
---|
383 | { |
---|
384 | prs_struct ps; |
---|
385 | uint32 checksum; |
---|
386 | |
---|
387 | /* grab the first block from the file */ |
---|
388 | |
---|
389 | if ( read_block( file, &ps, 0, REGF_BLOCKSIZE ) == -1 ) |
---|
390 | return false; |
---|
391 | |
---|
392 | /* parse the block and verify the checksum */ |
---|
393 | |
---|
394 | if ( !prs_regf_block( "regf_header", &ps, 0, file ) ) |
---|
395 | return false; |
---|
396 | |
---|
397 | checksum = regf_block_checksum( &ps ); |
---|
398 | |
---|
399 | if(ps.is_dynamic) |
---|
400 | SAFE_FREE(ps.data_p); |
---|
401 | ps.is_dynamic = false; |
---|
402 | ps.buffer_size = 0; |
---|
403 | ps.data_offset = 0; |
---|
404 | |
---|
405 | if ( file->checksum != checksum ) { |
---|
406 | /*DEBUG(0,("read_regf_block: invalid checksum\n" ));*/ |
---|
407 | return false; |
---|
408 | } |
---|
409 | |
---|
410 | return true; |
---|
411 | } |
---|
412 | |
---|
413 | |
---|
414 | /******************************************************************* |
---|
415 | *******************************************************************/ |
---|
416 | static REGF_HBIN* read_hbin_block( REGF_FILE *file, off_t offset ) |
---|
417 | { |
---|
418 | REGF_HBIN *hbin; |
---|
419 | uint32 record_size, curr_off, block_size, header; |
---|
420 | |
---|
421 | if ( !(hbin = (REGF_HBIN*)zalloc(sizeof(REGF_HBIN))) ) |
---|
422 | return NULL; |
---|
423 | hbin->file_off = offset; |
---|
424 | hbin->free_off = -1; |
---|
425 | |
---|
426 | if ( read_block( file, &hbin->ps, offset, 0 ) == -1 ) |
---|
427 | return NULL; |
---|
428 | |
---|
429 | if ( !prs_hbin_block( "hbin", &hbin->ps, 0, hbin ) ) |
---|
430 | return NULL; |
---|
431 | |
---|
432 | /* this should be the same thing as hbin->block_size but just in case */ |
---|
433 | |
---|
434 | block_size = hbin->ps.buffer_size; |
---|
435 | |
---|
436 | /* Find the available free space offset. Always at the end, |
---|
437 | so walk the record list and stop when you get to the end. |
---|
438 | The end is defined by a record header of 0xffffffff. The |
---|
439 | previous 4 bytes contains the amount of free space remaining |
---|
440 | in the hbin block. */ |
---|
441 | |
---|
442 | /* remember that the record_size is in the 4 bytes preceeding the record itself */ |
---|
443 | |
---|
444 | if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE-sizeof(uint32) ) ) |
---|
445 | return false; |
---|
446 | |
---|
447 | record_size = 0; |
---|
448 | curr_off = hbin->ps.data_offset; |
---|
449 | while ( header != 0xffffffff ) { |
---|
450 | /* not done yet so reset the current offset to the |
---|
451 | next record_size field */ |
---|
452 | |
---|
453 | curr_off = curr_off+record_size; |
---|
454 | |
---|
455 | /* for some reason the record_size of the last record in |
---|
456 | an hbin block can extend past the end of the block |
---|
457 | even though the record fits within the remaining |
---|
458 | space....aaarrrgggghhhhhh */ |
---|
459 | |
---|
460 | if ( curr_off >= block_size ) { |
---|
461 | record_size = -1; |
---|
462 | curr_off = -1; |
---|
463 | break; |
---|
464 | } |
---|
465 | |
---|
466 | if ( !prs_set_offset( &hbin->ps, curr_off) ) |
---|
467 | return false; |
---|
468 | |
---|
469 | if ( !prs_uint32( "rec_size", &hbin->ps, 0, &record_size ) ) |
---|
470 | return false; |
---|
471 | if ( !prs_uint32( "header", &hbin->ps, 0, &header ) ) |
---|
472 | return false; |
---|
473 | |
---|
474 | assert( record_size != 0 ); |
---|
475 | |
---|
476 | if ( record_size & 0x80000000 ) { |
---|
477 | /* absolute_value(record_size) */ |
---|
478 | record_size = (record_size ^ 0xffffffff) + 1; |
---|
479 | } |
---|
480 | } |
---|
481 | |
---|
482 | /* save the free space offset */ |
---|
483 | |
---|
484 | if ( header == 0xffffffff ) { |
---|
485 | |
---|
486 | /* account for the fact that the curr_off is 4 bytes behind the actual |
---|
487 | record header */ |
---|
488 | |
---|
489 | hbin->free_off = curr_off + sizeof(uint32); |
---|
490 | hbin->free_size = record_size; |
---|
491 | } |
---|
492 | |
---|
493 | /*DEBUG(10,("read_hbin_block: free space offset == 0x%x\n", hbin->free_off));*/ |
---|
494 | |
---|
495 | if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE ) ) |
---|
496 | return false; |
---|
497 | |
---|
498 | return hbin; |
---|
499 | } |
---|
500 | |
---|
501 | |
---|
502 | /******************************************************************* |
---|
503 | Input a randon offset and receive the correpsonding HBIN |
---|
504 | block for it |
---|
505 | *******************************************************************/ |
---|
506 | static bool hbin_contains_offset( REGF_HBIN *hbin, uint32 offset ) |
---|
507 | { |
---|
508 | if ( !hbin ) |
---|
509 | return false; |
---|
510 | |
---|
511 | if ( (offset > hbin->first_hbin_off) && (offset < (hbin->first_hbin_off+hbin->block_size)) ) |
---|
512 | return true; |
---|
513 | |
---|
514 | return false; |
---|
515 | } |
---|
516 | |
---|
517 | |
---|
518 | /******************************************************************* |
---|
519 | Input a randon offset and receive the correpsonding HBIN |
---|
520 | block for it |
---|
521 | *******************************************************************/ |
---|
522 | static REGF_HBIN* lookup_hbin_block( REGF_FILE *file, uint32 offset ) |
---|
523 | { |
---|
524 | REGF_HBIN *hbin = NULL; |
---|
525 | uint32 block_off; |
---|
526 | |
---|
527 | /* start with the open list */ |
---|
528 | |
---|
529 | for ( hbin=file->block_list; hbin; hbin=hbin->next ) { |
---|
530 | /* DEBUG(10,("lookup_hbin_block: address = 0x%x [0x%x]\n", hbin->file_off, (uint32)hbin ));*/ |
---|
531 | if ( hbin_contains_offset( hbin, offset ) ) |
---|
532 | return hbin; |
---|
533 | } |
---|
534 | |
---|
535 | if ( !hbin ) { |
---|
536 | /* start at the beginning */ |
---|
537 | |
---|
538 | block_off = REGF_BLOCKSIZE; |
---|
539 | do { |
---|
540 | /* cleanup before the next round */ |
---|
541 | if ( hbin ) |
---|
542 | { |
---|
543 | if(hbin->ps.is_dynamic) |
---|
544 | SAFE_FREE(hbin->ps.data_p); |
---|
545 | hbin->ps.is_dynamic = false; |
---|
546 | hbin->ps.buffer_size = 0; |
---|
547 | hbin->ps.data_offset = 0; |
---|
548 | } |
---|
549 | |
---|
550 | hbin = read_hbin_block( file, block_off ); |
---|
551 | |
---|
552 | if ( hbin ) |
---|
553 | block_off = hbin->file_off + hbin->block_size; |
---|
554 | |
---|
555 | } while ( hbin && !hbin_contains_offset( hbin, offset ) ); |
---|
556 | } |
---|
557 | |
---|
558 | if ( hbin ) |
---|
559 | DLIST_ADD( file->block_list, hbin ); |
---|
560 | |
---|
561 | return hbin; |
---|
562 | } |
---|
563 | |
---|
564 | |
---|
565 | /******************************************************************* |
---|
566 | *******************************************************************/ |
---|
567 | static bool prs_hash_rec( const char *desc, prs_struct *ps, int depth, REGF_HASH_REC *hash ) |
---|
568 | { |
---|
569 | depth++; |
---|
570 | |
---|
571 | if ( !prs_uint32( "nk_off", ps, depth, &hash->nk_off )) |
---|
572 | return false; |
---|
573 | if ( !prs_uint8s( true, "keycheck", ps, depth, hash->keycheck, sizeof( hash->keycheck )) ) |
---|
574 | return false; |
---|
575 | |
---|
576 | return true; |
---|
577 | } |
---|
578 | |
---|
579 | |
---|
580 | /******************************************************************* |
---|
581 | *******************************************************************/ |
---|
582 | static bool hbin_prs_lf_records( const char *desc, REGF_HBIN *hbin, int depth, REGF_NK_REC *nk ) |
---|
583 | { |
---|
584 | int i; |
---|
585 | REGF_LF_REC *lf = &nk->subkeys; |
---|
586 | uint32 data_size, start_off, end_off; |
---|
587 | |
---|
588 | depth++; |
---|
589 | |
---|
590 | /* check if we have anything to do first */ |
---|
591 | |
---|
592 | if ( nk->num_subkeys == 0 ) |
---|
593 | return true; |
---|
594 | |
---|
595 | /* move to the LF record */ |
---|
596 | |
---|
597 | if ( !prs_set_offset( &hbin->ps, nk->subkeys_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) ) |
---|
598 | return false; |
---|
599 | |
---|
600 | /* backup and get the data_size */ |
---|
601 | |
---|
602 | if ( !prs_set_offset( &hbin->ps, hbin->ps.data_offset-sizeof(uint32)) ) |
---|
603 | return false; |
---|
604 | start_off = hbin->ps.data_offset; |
---|
605 | if ( !prs_uint32( "rec_size", &hbin->ps, depth, &lf->rec_size )) |
---|
606 | return false; |
---|
607 | |
---|
608 | if ( !prs_uint8s( true, "header", &hbin->ps, depth, lf->header, sizeof( lf->header )) ) |
---|
609 | return false; |
---|
610 | |
---|
611 | if ( !prs_uint16( "num_keys", &hbin->ps, depth, &lf->num_keys)) |
---|
612 | return false; |
---|
613 | |
---|
614 | if ( hbin->ps.io ) { |
---|
615 | if ( !(lf->hashes = (REGF_HASH_REC*)zcalloc(sizeof(REGF_HASH_REC), lf->num_keys )) ) |
---|
616 | return false; |
---|
617 | } |
---|
618 | |
---|
619 | for ( i=0; i<lf->num_keys; i++ ) { |
---|
620 | if ( !prs_hash_rec( "hash_rec", &hbin->ps, depth, &lf->hashes[i] ) ) |
---|
621 | return false; |
---|
622 | } |
---|
623 | |
---|
624 | end_off = hbin->ps.data_offset; |
---|
625 | |
---|
626 | /* data_size must be divisible by 8 and large enough to hold the original record */ |
---|
627 | |
---|
628 | data_size = ((start_off - end_off) & 0xfffffff8 ); |
---|
629 | if ( data_size > lf->rec_size ) |
---|
630 | /*DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, lf->rec_size));*/ |
---|
631 | |
---|
632 | if ( !hbin->ps.io ) |
---|
633 | hbin->dirty = true; |
---|
634 | |
---|
635 | return true; |
---|
636 | } |
---|
637 | |
---|
638 | |
---|
639 | /******************************************************************* |
---|
640 | *******************************************************************/ |
---|
641 | static bool hbin_prs_sk_rec( const char *desc, REGF_HBIN *hbin, int depth, REGF_SK_REC *sk ) |
---|
642 | { |
---|
643 | prs_struct *ps = &hbin->ps; |
---|
644 | uint16 tag = 0xFFFF; |
---|
645 | uint32 data_size, start_off, end_off; |
---|
646 | |
---|
647 | |
---|
648 | depth++; |
---|
649 | |
---|
650 | if ( !prs_set_offset( &hbin->ps, sk->sk_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) ) |
---|
651 | return false; |
---|
652 | |
---|
653 | /* backup and get the data_size */ |
---|
654 | |
---|
655 | if ( !prs_set_offset( &hbin->ps, hbin->ps.data_offset-sizeof(uint32)) ) |
---|
656 | return false; |
---|
657 | start_off = hbin->ps.data_offset; |
---|
658 | if ( !prs_uint32( "rec_size", &hbin->ps, depth, &sk->rec_size )) |
---|
659 | return false; |
---|
660 | |
---|
661 | if ( !prs_uint8s( true, "header", ps, depth, sk->header, sizeof( sk->header )) ) |
---|
662 | return false; |
---|
663 | if ( !prs_uint16( "tag", ps, depth, &tag)) |
---|
664 | return false; |
---|
665 | |
---|
666 | if ( !prs_uint32( "prev_sk_off", ps, depth, &sk->prev_sk_off)) |
---|
667 | return false; |
---|
668 | if ( !prs_uint32( "next_sk_off", ps, depth, &sk->next_sk_off)) |
---|
669 | return false; |
---|
670 | if ( !prs_uint32( "ref_count", ps, depth, &sk->ref_count)) |
---|
671 | return false; |
---|
672 | if ( !prs_uint32( "size", ps, depth, &sk->size)) |
---|
673 | return false; |
---|
674 | |
---|
675 | if ( !sec_io_desc( "sec_desc", &sk->sec_desc, ps, depth )) |
---|
676 | return false; |
---|
677 | |
---|
678 | end_off = hbin->ps.data_offset; |
---|
679 | |
---|
680 | /* data_size must be divisible by 8 and large enough to hold the original record */ |
---|
681 | |
---|
682 | data_size = ((start_off - end_off) & 0xfffffff8 ); |
---|
683 | if ( data_size > sk->rec_size ) |
---|
684 | /*DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, sk->rec_size));*/ |
---|
685 | |
---|
686 | if ( !hbin->ps.io ) |
---|
687 | hbin->dirty = true; |
---|
688 | |
---|
689 | return true; |
---|
690 | } |
---|
691 | |
---|
692 | |
---|
693 | /******************************************************************* |
---|
694 | *******************************************************************/ |
---|
695 | static bool hbin_prs_vk_rec( const char *desc, REGF_HBIN *hbin, int depth, |
---|
696 | REGF_VK_REC *vk, REGF_FILE *file ) |
---|
697 | { |
---|
698 | uint32 offset; |
---|
699 | uint16 name_length; |
---|
700 | prs_struct *ps = &hbin->ps; |
---|
701 | uint32 data_size, start_off, end_off; |
---|
702 | |
---|
703 | depth++; |
---|
704 | |
---|
705 | /* backup and get the data_size */ |
---|
706 | |
---|
707 | if ( !prs_set_offset( &hbin->ps, hbin->ps.data_offset-sizeof(uint32)) ) |
---|
708 | return false; |
---|
709 | start_off = hbin->ps.data_offset; |
---|
710 | if ( !prs_uint32( "rec_size", &hbin->ps, depth, &vk->rec_size )) |
---|
711 | return false; |
---|
712 | |
---|
713 | if ( !prs_uint8s( true, "header", ps, depth, vk->header, sizeof( vk->header )) ) |
---|
714 | return false; |
---|
715 | |
---|
716 | if ( !hbin->ps.io ) |
---|
717 | name_length = strlen(vk->valuename); |
---|
718 | |
---|
719 | if ( !prs_uint16( "name_length", ps, depth, &name_length )) |
---|
720 | return false; |
---|
721 | if ( !prs_uint32( "data_size", ps, depth, &vk->data_size )) |
---|
722 | return false; |
---|
723 | if ( !prs_uint32( "data_off", ps, depth, &vk->data_off )) |
---|
724 | return false; |
---|
725 | if ( !prs_uint32( "type", ps, depth, &vk->type)) |
---|
726 | return false; |
---|
727 | if ( !prs_uint16( "flag", ps, depth, &vk->flag)) |
---|
728 | return false; |
---|
729 | |
---|
730 | offset = ps->data_offset; |
---|
731 | offset += 2; /* skip 2 bytes */ |
---|
732 | prs_set_offset( ps, offset ); |
---|
733 | |
---|
734 | /* get the name */ |
---|
735 | |
---|
736 | if ( vk->flag&VK_FLAG_NAME_PRESENT ) { |
---|
737 | |
---|
738 | if ( hbin->ps.io ) { |
---|
739 | if ( !(vk->valuename = (char*)zcalloc(sizeof(char), name_length+1 ))) |
---|
740 | return false; |
---|
741 | } |
---|
742 | if ( !prs_uint8s( true, "name", ps, depth, vk->valuename, name_length ) ) |
---|
743 | return false; |
---|
744 | } |
---|
745 | |
---|
746 | end_off = hbin->ps.data_offset; |
---|
747 | |
---|
748 | /* get the data if necessary */ |
---|
749 | |
---|
750 | if ( vk->data_size != 0 ) |
---|
751 | { |
---|
752 | bool charmode = false; |
---|
753 | |
---|
754 | if ( (vk->type == REG_SZ) || (vk->type == REG_MULTI_SZ) ) |
---|
755 | charmode = true; |
---|
756 | |
---|
757 | /* the data is stored in the offset if the size <= 4 */ |
---|
758 | if ( !(vk->data_size & VK_DATA_IN_OFFSET) ) |
---|
759 | { |
---|
760 | REGF_HBIN *hblock = hbin; |
---|
761 | uint32 data_rec_size; |
---|
762 | |
---|
763 | if ( hbin->ps.io ) |
---|
764 | { |
---|
765 | if ( !(vk->data = (uint8*)zcalloc(sizeof(uint8), vk->data_size) ) ) |
---|
766 | return false; |
---|
767 | } |
---|
768 | |
---|
769 | /* this data can be in another hbin */ |
---|
770 | if ( !hbin_contains_offset( hbin, vk->data_off ) ) |
---|
771 | { |
---|
772 | if ( !(hblock = lookup_hbin_block( file, vk->data_off )) ) |
---|
773 | return false; |
---|
774 | } |
---|
775 | if (!(prs_set_offset(&hblock->ps, |
---|
776 | (vk->data_off |
---|
777 | + HBIN_HDR_SIZE |
---|
778 | - hblock->first_hbin_off) |
---|
779 | - sizeof(uint32)))) |
---|
780 | { return false; } |
---|
781 | |
---|
782 | if ( !hblock->ps.io ) |
---|
783 | { |
---|
784 | data_rec_size = ( (vk->data_size+sizeof(uint32)) & 0xfffffff8 ) + 8; |
---|
785 | data_rec_size = ( data_rec_size - 1 ) ^ 0xFFFFFFFF; |
---|
786 | } |
---|
787 | if ( !prs_uint32( "data_rec_size", &hblock->ps, depth, &data_rec_size )) |
---|
788 | return false; |
---|
789 | if(!prs_uint8s(charmode, "data", &hblock->ps, depth, |
---|
790 | vk->data, vk->data_size)) |
---|
791 | return false; |
---|
792 | |
---|
793 | if ( !hblock->ps.io ) |
---|
794 | hblock->dirty = true; |
---|
795 | } |
---|
796 | else |
---|
797 | { |
---|
798 | if(!(vk->data = zcalloc(sizeof(uint8), 4))) |
---|
799 | return false; |
---|
800 | SIVAL( vk->data, 0, vk->data_off ); |
---|
801 | } |
---|
802 | |
---|
803 | } |
---|
804 | |
---|
805 | /* data_size must be divisible by 8 and large enough to hold the original record */ |
---|
806 | |
---|
807 | data_size = ((start_off - end_off ) & 0xfffffff8 ); |
---|
808 | /*if ( data_size != vk->rec_size ) |
---|
809 | DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size, vk->rec_size));*/ |
---|
810 | |
---|
811 | if ( !hbin->ps.io ) |
---|
812 | hbin->dirty = true; |
---|
813 | |
---|
814 | return true; |
---|
815 | } |
---|
816 | |
---|
817 | |
---|
818 | /******************************************************************* |
---|
819 | read a VK record which is contained in the HBIN block stored |
---|
820 | in the prs_struct *ps. |
---|
821 | *******************************************************************/ |
---|
822 | static bool hbin_prs_vk_records(const char *desc, REGF_HBIN *hbin, |
---|
823 | int depth, REGF_NK_REC *nk, REGF_FILE *file) |
---|
824 | { |
---|
825 | int i; |
---|
826 | uint32 record_size; |
---|
827 | |
---|
828 | depth++; |
---|
829 | |
---|
830 | /* check if we have anything to do first */ |
---|
831 | if(nk->num_values == 0) |
---|
832 | return true; |
---|
833 | |
---|
834 | if(hbin->ps.io) |
---|
835 | { |
---|
836 | if (!(nk->values = (REGF_VK_REC*)zcalloc(sizeof(REGF_VK_REC), |
---|
837 | nk->num_values ))) |
---|
838 | return false; |
---|
839 | } |
---|
840 | |
---|
841 | /* convert the offset to something relative to this HBIN block */ |
---|
842 | if (!prs_set_offset(&hbin->ps, |
---|
843 | nk->values_off |
---|
844 | + HBIN_HDR_SIZE |
---|
845 | - hbin->first_hbin_off |
---|
846 | - sizeof(uint32))) |
---|
847 | { return false; } |
---|
848 | |
---|
849 | if ( !hbin->ps.io ) |
---|
850 | { |
---|
851 | record_size = ( ( nk->num_values * sizeof(uint32) ) & 0xfffffff8 ) + 8; |
---|
852 | record_size = (record_size - 1) ^ 0xFFFFFFFF; |
---|
853 | } |
---|
854 | |
---|
855 | if ( !prs_uint32( "record_size", &hbin->ps, depth, &record_size ) ) |
---|
856 | return false; |
---|
857 | |
---|
858 | for ( i=0; i<nk->num_values; i++ ) |
---|
859 | { |
---|
860 | if ( !prs_uint32( "vk_off", &hbin->ps, depth, &nk->values[i].rec_off ) ) |
---|
861 | return false; |
---|
862 | } |
---|
863 | |
---|
864 | for ( i=0; i<nk->num_values; i++ ) |
---|
865 | { |
---|
866 | REGF_HBIN *sub_hbin = hbin; |
---|
867 | uint32 new_offset; |
---|
868 | |
---|
869 | if ( !hbin_contains_offset( hbin, nk->values[i].rec_off ) ) |
---|
870 | { |
---|
871 | sub_hbin = lookup_hbin_block( file, nk->values[i].rec_off ); |
---|
872 | if ( !sub_hbin ) |
---|
873 | { |
---|
874 | /*DEBUG(0,("hbin_prs_vk_records: Failed to find HBIN block containing offset [0x%x]\n", |
---|
875 | nk->values[i].hbin_off));*/ |
---|
876 | return false; |
---|
877 | } |
---|
878 | } |
---|
879 | |
---|
880 | new_offset = nk->values[i].rec_off |
---|
881 | + HBIN_HDR_SIZE |
---|
882 | - sub_hbin->first_hbin_off; |
---|
883 | |
---|
884 | if (!prs_set_offset(&sub_hbin->ps, new_offset)) |
---|
885 | return false; |
---|
886 | if (!hbin_prs_vk_rec("vk_rec", sub_hbin, depth, &nk->values[i], file)) |
---|
887 | return false; |
---|
888 | } |
---|
889 | |
---|
890 | if ( !hbin->ps.io ) |
---|
891 | hbin->dirty = true; |
---|
892 | |
---|
893 | return true; |
---|
894 | } |
---|
895 | |
---|
896 | |
---|
897 | /******************************************************************* |
---|
898 | *******************************************************************/ |
---|
899 | static REGF_SK_REC* find_sk_record_by_offset( REGF_FILE *file, uint32 offset ) |
---|
900 | { |
---|
901 | REGF_SK_REC *p_sk; |
---|
902 | |
---|
903 | for ( p_sk=file->sec_desc_list; p_sk; p_sk=p_sk->next ) { |
---|
904 | if ( p_sk->sk_off == offset ) |
---|
905 | return p_sk; |
---|
906 | } |
---|
907 | |
---|
908 | return NULL; |
---|
909 | } |
---|
910 | |
---|
911 | |
---|
912 | /******************************************************************* |
---|
913 | *******************************************************************/ |
---|
914 | static REGF_SK_REC* find_sk_record_by_sec_desc( REGF_FILE *file, SEC_DESC *sd ) |
---|
915 | { |
---|
916 | REGF_SK_REC *p; |
---|
917 | |
---|
918 | for ( p=file->sec_desc_list; p; p=p->next ) { |
---|
919 | if ( sec_desc_equal( p->sec_desc, sd ) ) |
---|
920 | return p; |
---|
921 | } |
---|
922 | |
---|
923 | /* failure */ |
---|
924 | |
---|
925 | return NULL; |
---|
926 | } |
---|
927 | |
---|
928 | |
---|
929 | /******************************************************************* |
---|
930 | *******************************************************************/ |
---|
931 | static bool hbin_prs_key( REGF_FILE *file, REGF_HBIN *hbin, REGF_NK_REC *nk ) |
---|
932 | { |
---|
933 | int depth = 0; |
---|
934 | REGF_HBIN *sub_hbin; |
---|
935 | |
---|
936 | depth++; |
---|
937 | |
---|
938 | /* get the initial nk record */ |
---|
939 | |
---|
940 | if ( !prs_nk_rec( "nk_rec", &hbin->ps, depth, nk )) |
---|
941 | return false; |
---|
942 | |
---|
943 | /* fill in values */ |
---|
944 | |
---|
945 | if ( nk->num_values && (nk->values_off!=REGF_OFFSET_NONE) ) |
---|
946 | { |
---|
947 | sub_hbin = hbin; |
---|
948 | if ( !hbin_contains_offset( hbin, nk->values_off ) ) |
---|
949 | { |
---|
950 | sub_hbin = lookup_hbin_block( file, nk->values_off ); |
---|
951 | if ( !sub_hbin ) |
---|
952 | { |
---|
953 | /*DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing value_list_offset [0x%x]\n", |
---|
954 | nk->values_off));*/ |
---|
955 | return false; |
---|
956 | } |
---|
957 | } |
---|
958 | |
---|
959 | if(!hbin_prs_vk_records("vk_rec", sub_hbin, depth, nk, file)) |
---|
960 | return false; |
---|
961 | } |
---|
962 | |
---|
963 | /* now get subkeys */ |
---|
964 | if ( nk->num_subkeys && (nk->subkeys_off!=REGF_OFFSET_NONE) ) |
---|
965 | { |
---|
966 | sub_hbin = hbin; |
---|
967 | if ( !hbin_contains_offset( hbin, nk->subkeys_off ) ) |
---|
968 | { |
---|
969 | sub_hbin = lookup_hbin_block( file, nk->subkeys_off ); |
---|
970 | if ( !sub_hbin ) |
---|
971 | { |
---|
972 | /*DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing subkey_offset [0x%x]\n", |
---|
973 | nk->subkeys_off));*/ |
---|
974 | return false; |
---|
975 | } |
---|
976 | } |
---|
977 | |
---|
978 | if (!hbin_prs_lf_records("lf_rec", sub_hbin, depth, nk)) |
---|
979 | return false; |
---|
980 | } |
---|
981 | |
---|
982 | /* get the to the security descriptor. First look if we have already parsed it */ |
---|
983 | |
---|
984 | if ((nk->sk_off!=REGF_OFFSET_NONE) |
---|
985 | && !(nk->sec_desc = find_sk_record_by_offset( file, nk->sk_off ))) |
---|
986 | { |
---|
987 | sub_hbin = hbin; |
---|
988 | if (!hbin_contains_offset(hbin, nk->sk_off)) |
---|
989 | { |
---|
990 | sub_hbin = lookup_hbin_block( file, nk->sk_off ); |
---|
991 | if ( !sub_hbin ) { |
---|
992 | /*DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing sk_offset [0x%x]\n", |
---|
993 | nk->subkeys_off));*/ |
---|
994 | return false; |
---|
995 | } |
---|
996 | } |
---|
997 | |
---|
998 | if ( !(nk->sec_desc = (REGF_SK_REC*)zalloc(sizeof(REGF_SK_REC) )) ) |
---|
999 | return false; |
---|
1000 | nk->sec_desc->sk_off = nk->sk_off; |
---|
1001 | if ( !hbin_prs_sk_rec( "sk_rec", sub_hbin, depth, nk->sec_desc )) |
---|
1002 | return false; |
---|
1003 | |
---|
1004 | /* add to the list of security descriptors (ref_count has been read from the files) */ |
---|
1005 | |
---|
1006 | nk->sec_desc->sk_off = nk->sk_off; |
---|
1007 | DLIST_ADD( file->sec_desc_list, nk->sec_desc ); |
---|
1008 | } |
---|
1009 | |
---|
1010 | return true; |
---|
1011 | } |
---|
1012 | |
---|
1013 | |
---|
1014 | /******************************************************************* |
---|
1015 | *******************************************************************/ |
---|
1016 | static bool next_record( REGF_HBIN *hbin, const char *hdr, bool *eob ) |
---|
1017 | { |
---|
1018 | char header[REC_HDR_SIZE] = ""; |
---|
1019 | uint32 record_size; |
---|
1020 | uint32 curr_off, block_size; |
---|
1021 | bool found = false; |
---|
1022 | prs_struct *ps = &hbin->ps; |
---|
1023 | |
---|
1024 | curr_off = ps->data_offset; |
---|
1025 | if ( curr_off == 0 ) |
---|
1026 | prs_set_offset( ps, HBIN_HEADER_REC_SIZE ); |
---|
1027 | |
---|
1028 | /* assume that the current offset is at the reacord header |
---|
1029 | and we need to backup to read the record size */ |
---|
1030 | curr_off -= sizeof(uint32); |
---|
1031 | |
---|
1032 | block_size = ps->buffer_size; |
---|
1033 | record_size = 0; |
---|
1034 | while ( !found ) |
---|
1035 | { |
---|
1036 | curr_off = curr_off+record_size; |
---|
1037 | if ( curr_off >= block_size ) |
---|
1038 | break; |
---|
1039 | |
---|
1040 | if ( !prs_set_offset( &hbin->ps, curr_off) ) |
---|
1041 | return false; |
---|
1042 | |
---|
1043 | if ( !prs_uint32( "record_size", ps, 0, &record_size ) ) |
---|
1044 | return false; |
---|
1045 | if ( !prs_uint8s( true, "header", ps, 0, header, REC_HDR_SIZE ) ) |
---|
1046 | return false; |
---|
1047 | |
---|
1048 | if ( record_size & 0x80000000 ) { |
---|
1049 | /* absolute_value(record_size) */ |
---|
1050 | record_size = (record_size ^ 0xffffffff) + 1; |
---|
1051 | } |
---|
1052 | |
---|
1053 | if ( memcmp( header, hdr, REC_HDR_SIZE ) == 0 ) { |
---|
1054 | found = true; |
---|
1055 | curr_off += sizeof(uint32); |
---|
1056 | } |
---|
1057 | } |
---|
1058 | |
---|
1059 | /* mark prs_struct as done ( at end ) if no more SK records */ |
---|
1060 | /* mark end-of-block as true */ |
---|
1061 | if ( !found ) |
---|
1062 | { |
---|
1063 | prs_set_offset( &hbin->ps, hbin->ps.buffer_size ); |
---|
1064 | *eob = true; |
---|
1065 | return false; |
---|
1066 | } |
---|
1067 | |
---|
1068 | if (!prs_set_offset(ps, curr_off)) |
---|
1069 | return false; |
---|
1070 | |
---|
1071 | return true; |
---|
1072 | } |
---|
1073 | |
---|
1074 | |
---|
1075 | /******************************************************************* |
---|
1076 | *******************************************************************/ |
---|
1077 | static bool next_nk_record(REGF_FILE *file, REGF_HBIN *hbin, |
---|
1078 | REGF_NK_REC *nk, bool *eob) |
---|
1079 | { |
---|
1080 | if (next_record(hbin, "nk", eob) |
---|
1081 | && hbin_prs_key(file, hbin, nk)) |
---|
1082 | return true; |
---|
1083 | |
---|
1084 | return false; |
---|
1085 | } |
---|
1086 | |
---|
1087 | |
---|
1088 | /******************************************************************* |
---|
1089 | Open the registry file and then read in the REGF block to get the |
---|
1090 | first hbin offset. |
---|
1091 | *******************************************************************/ |
---|
1092 | REGF_FILE* regfio_open( const char *filename ) |
---|
1093 | { |
---|
1094 | REGF_FILE *rb; |
---|
1095 | int flags = O_RDONLY; |
---|
1096 | |
---|
1097 | if ( !(rb = (REGF_FILE*)malloc(sizeof(REGF_FILE))) ) { |
---|
1098 | /* DEBUG(0,("ERROR allocating memory\n")); */ |
---|
1099 | return NULL; |
---|
1100 | } |
---|
1101 | memset(rb, 0, sizeof(REGF_FILE)); |
---|
1102 | rb->fd = -1; |
---|
1103 | |
---|
1104 | /* if ( !(rb->mem_ctx = talloc_init( "read_regf_block" )) ) |
---|
1105 | { |
---|
1106 | regfio_close( rb ); |
---|
1107 | return NULL; |
---|
1108 | } |
---|
1109 | */ |
---|
1110 | rb->open_flags = flags; |
---|
1111 | |
---|
1112 | /* open and existing file */ |
---|
1113 | |
---|
1114 | if ( (rb->fd = open(filename, flags)) == -1 ) { |
---|
1115 | /* DEBUG(0,("regfio_open: failure to open %s (%s)\n", filename, strerror(errno)));*/ |
---|
1116 | regfio_close( rb ); |
---|
1117 | return NULL; |
---|
1118 | } |
---|
1119 | |
---|
1120 | /* read in an existing file */ |
---|
1121 | |
---|
1122 | if ( !read_regf_block( rb ) ) { |
---|
1123 | /* DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));*/ |
---|
1124 | regfio_close( rb ); |
---|
1125 | return NULL; |
---|
1126 | } |
---|
1127 | |
---|
1128 | /* success */ |
---|
1129 | |
---|
1130 | return rb; |
---|
1131 | } |
---|
1132 | |
---|
1133 | |
---|
1134 | /******************************************************************* |
---|
1135 | *******************************************************************/ |
---|
1136 | static void regfio_mem_free( REGF_FILE *file ) |
---|
1137 | { |
---|
1138 | /* free any zalloc()'d memory */ |
---|
1139 | |
---|
1140 | /* if ( file && file->mem_ctx ) |
---|
1141 | free(file->mem_ctx); |
---|
1142 | */ |
---|
1143 | } |
---|
1144 | |
---|
1145 | |
---|
1146 | /******************************************************************* |
---|
1147 | *******************************************************************/ |
---|
1148 | int regfio_close( REGF_FILE *file ) |
---|
1149 | { |
---|
1150 | int fd; |
---|
1151 | |
---|
1152 | regfio_mem_free( file ); |
---|
1153 | |
---|
1154 | /* nothing to do if there is no open file */ |
---|
1155 | |
---|
1156 | if ( !file || (file->fd == -1) ) |
---|
1157 | return 0; |
---|
1158 | |
---|
1159 | fd = file->fd; |
---|
1160 | file->fd = -1; |
---|
1161 | SAFE_FREE( file ); |
---|
1162 | |
---|
1163 | return close( fd ); |
---|
1164 | } |
---|
1165 | |
---|
1166 | |
---|
1167 | /******************************************************************* |
---|
1168 | There should be only *one* root key in the registry file based |
---|
1169 | on my experience. --jerry |
---|
1170 | *******************************************************************/ |
---|
1171 | REGF_NK_REC* regfio_rootkey( REGF_FILE *file ) |
---|
1172 | { |
---|
1173 | REGF_NK_REC *nk; |
---|
1174 | REGF_HBIN *hbin; |
---|
1175 | uint32 offset = REGF_BLOCKSIZE; |
---|
1176 | bool found = false; |
---|
1177 | bool eob; |
---|
1178 | |
---|
1179 | if ( !file ) |
---|
1180 | return NULL; |
---|
1181 | |
---|
1182 | if ( !(nk = (REGF_NK_REC*)zalloc(sizeof(REGF_NK_REC) )) ) { |
---|
1183 | /*DEBUG(0,("regfio_rootkey: zalloc() failed!\n"));*/ |
---|
1184 | return NULL; |
---|
1185 | } |
---|
1186 | |
---|
1187 | /* scan through the file on HBIN block at a time looking |
---|
1188 | for an NK record with a type == 0x002c. |
---|
1189 | Normally this is the first nk record in the first hbin |
---|
1190 | block (but I'm not assuming that for now) */ |
---|
1191 | |
---|
1192 | while ( (hbin = read_hbin_block( file, offset )) ) { |
---|
1193 | eob = false; |
---|
1194 | |
---|
1195 | while ( !eob) { |
---|
1196 | if ( next_nk_record( file, hbin, nk, &eob ) ) { |
---|
1197 | if ( nk->key_type == NK_TYPE_ROOTKEY ) { |
---|
1198 | found = true; |
---|
1199 | break; |
---|
1200 | } |
---|
1201 | } |
---|
1202 | if(hbin->ps.is_dynamic) |
---|
1203 | SAFE_FREE(hbin->ps.data_p); |
---|
1204 | hbin->ps.is_dynamic = false; |
---|
1205 | hbin->ps.buffer_size = 0; |
---|
1206 | hbin->ps.data_offset = 0; |
---|
1207 | } |
---|
1208 | |
---|
1209 | if ( found ) |
---|
1210 | break; |
---|
1211 | |
---|
1212 | offset += hbin->block_size; |
---|
1213 | } |
---|
1214 | |
---|
1215 | if ( !found ) { |
---|
1216 | /*DEBUG(0,("regfio_rootkey: corrupt registry file ? No root key record located\n"));*/ |
---|
1217 | return NULL; |
---|
1218 | } |
---|
1219 | |
---|
1220 | DLIST_ADD( file->block_list, hbin ); |
---|
1221 | |
---|
1222 | return nk; |
---|
1223 | } |
---|
1224 | |
---|
1225 | |
---|
1226 | /******************************************************************* |
---|
1227 | This acts as an interator over the subkeys defined for a given |
---|
1228 | NK record. Remember that offsets are from the *first* HBIN block. |
---|
1229 | *******************************************************************/ |
---|
1230 | REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk ) |
---|
1231 | { |
---|
1232 | REGF_NK_REC *subkey; |
---|
1233 | REGF_HBIN *hbin; |
---|
1234 | uint32 nk_offset; |
---|
1235 | |
---|
1236 | /* see if there is anything left to report */ |
---|
1237 | if (!nk || (nk->subkeys_off==REGF_OFFSET_NONE) |
---|
1238 | || (nk->subkey_index >= nk->num_subkeys)) |
---|
1239 | return NULL; |
---|
1240 | |
---|
1241 | /* find the HBIN block which should contain the nk record */ |
---|
1242 | if(!(hbin |
---|
1243 | = lookup_hbin_block(file, nk->subkeys.hashes[nk->subkey_index].nk_off ))) |
---|
1244 | { |
---|
1245 | /*DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n", |
---|
1246 | nk->subkeys.hashes[nk->subkey_index].nk_off));*/ |
---|
1247 | return NULL; |
---|
1248 | } |
---|
1249 | |
---|
1250 | nk_offset = nk->subkeys.hashes[nk->subkey_index].nk_off; |
---|
1251 | if(!prs_set_offset(&hbin->ps, |
---|
1252 | (HBIN_HDR_SIZE + nk_offset - hbin->first_hbin_off))) |
---|
1253 | return NULL; |
---|
1254 | |
---|
1255 | nk->subkey_index++; |
---|
1256 | if(!(subkey = (REGF_NK_REC*)zalloc(sizeof(REGF_NK_REC)))) |
---|
1257 | return NULL; |
---|
1258 | |
---|
1259 | if(!hbin_prs_key(file, hbin, subkey)) |
---|
1260 | return NULL; |
---|
1261 | |
---|
1262 | return subkey; |
---|
1263 | } |
---|