[204] | 1 | #!/usr/bin/env python |
---|
| 2 | |
---|
[221] | 3 | ## @package pyregfi.structures |
---|
| 4 | # Low-level data structures and C API mappings. |
---|
| 5 | # |
---|
| 6 | # Most users need not venture here. For more information, see the source. |
---|
| 7 | |
---|
[204] | 8 | import sys |
---|
| 9 | import os |
---|
| 10 | import traceback |
---|
| 11 | import ctypes |
---|
| 12 | import ctypes.util |
---|
[205] | 13 | from ctypes import * |
---|
[204] | 14 | |
---|
[221] | 15 | |
---|
[205] | 16 | # XXX: can we always be sure enums are this size? |
---|
| 17 | REGFI_ENCODING = c_uint32 |
---|
[213] | 18 | REGFI_ENCODING_UTF8 = 1 |
---|
| 19 | |
---|
[205] | 20 | REGFI_DATA_TYPE = c_uint32 |
---|
[221] | 21 | REGFI_REGF_SIZE = 0x1000 |
---|
[204] | 22 | |
---|
[205] | 23 | |
---|
| 24 | # Prototype everything first so we don't have to worry about reference order |
---|
| 25 | class REGFI_NTTIME(Structure): |
---|
| 26 | pass |
---|
| 27 | |
---|
| 28 | class REGFI_VK(Structure): |
---|
| 29 | pass |
---|
| 30 | |
---|
| 31 | class REGFI_SK(Structure): |
---|
| 32 | pass |
---|
| 33 | |
---|
| 34 | class REGFI_SUBKEY_LIST(Structure): |
---|
| 35 | pass |
---|
| 36 | |
---|
| 37 | class REGFI_VALUE_LIST(Structure): |
---|
| 38 | pass |
---|
| 39 | |
---|
| 40 | class REGFI_CLASSNAME(Structure): |
---|
| 41 | pass |
---|
| 42 | |
---|
| 43 | class REGFI_DATA(Structure): |
---|
| 44 | pass |
---|
| 45 | |
---|
| 46 | class REGFI_NK(Structure): |
---|
| 47 | pass |
---|
| 48 | |
---|
| 49 | class REGFI_ITERATOR(Structure): |
---|
| 50 | pass |
---|
| 51 | |
---|
| 52 | class REGFI_FILE(Structure): |
---|
| 53 | pass |
---|
| 54 | |
---|
| 55 | class REGFI_RAW_FILE(Structure): |
---|
[204] | 56 | fh = None |
---|
| 57 | |
---|
| 58 | def cb_seek(self, raw_file, offset, whence): |
---|
| 59 | try: |
---|
| 60 | self.fh.seek(offset, whence) |
---|
| 61 | except Exception: |
---|
| 62 | traceback.print_exc() |
---|
| 63 | # XXX: os.EX_IOERR may not be available on Windoze |
---|
[205] | 64 | set_errno(os.EX_IOERR) |
---|
[204] | 65 | return -1 |
---|
| 66 | |
---|
| 67 | return self.fh.tell() |
---|
| 68 | |
---|
| 69 | |
---|
| 70 | def cb_read(self, raw_file, buf, count): |
---|
| 71 | try: |
---|
| 72 | # XXX: anyway to do a readinto() here? |
---|
| 73 | tmp = self.fh.read(count) |
---|
[205] | 74 | memmove(buf,tmp,len(tmp)) |
---|
[204] | 75 | |
---|
| 76 | except Exception: |
---|
| 77 | traceback.print_exc() |
---|
| 78 | # XXX: os.EX_IOERR may not be available on Windoze |
---|
[205] | 79 | set_errno(os.EX_IOERR) |
---|
[204] | 80 | return -1 |
---|
| 81 | return len(tmp) |
---|
| 82 | |
---|
| 83 | |
---|
| 84 | # XXX: how can we know for sure the size of off_t and size_t? |
---|
[205] | 85 | seek_cb_type = CFUNCTYPE(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True) |
---|
| 86 | read_cb_type = CFUNCTYPE(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_uint64, use_errno=True) |
---|
[204] | 87 | |
---|
| 88 | |
---|
[205] | 89 | REGFI_NTTIME._fields_ = [('low', c_uint32), |
---|
| 90 | ('high', c_uint32)] |
---|
| 91 | |
---|
| 92 | REGFI_VK._fields_ = [('offset', c_uint32), |
---|
| 93 | ('cell_size', c_uint32), |
---|
[206] | 94 | ('name', c_char_p), |
---|
| 95 | ('name_raw', POINTER(c_char)), |
---|
[205] | 96 | ('name_length', c_uint16), |
---|
| 97 | ('hbin_off', c_uint32), |
---|
| 98 | ('data_size', c_uint32), |
---|
| 99 | ('data_off', c_uint32), |
---|
| 100 | ('type', REGFI_DATA_TYPE), |
---|
| 101 | ('magic', c_char * 2), |
---|
| 102 | ('flags', c_uint16), |
---|
| 103 | ('unknown1', c_uint16), |
---|
| 104 | ('data_in_offset', c_bool), |
---|
| 105 | ] |
---|
| 106 | |
---|
| 107 | |
---|
| 108 | REGFI_SK._fields_ = [('offset', c_uint32), |
---|
| 109 | ('cell_size', c_uint32), |
---|
| 110 | ('sec_desc', c_void_p), #XXX |
---|
| 111 | ('hbin_off', c_uint32), |
---|
| 112 | ('prev_sk_off', c_uint32), |
---|
| 113 | ('next_sk_off', c_uint32), |
---|
| 114 | ('ref_count', c_uint32), |
---|
| 115 | ('desc_size', c_uint32), |
---|
| 116 | ('unknown_tag', c_uint16), |
---|
| 117 | ('magic', c_char * 2), |
---|
| 118 | ] |
---|
| 119 | |
---|
| 120 | |
---|
| 121 | REGFI_NK._fields_ = [('offset', c_uint32), |
---|
| 122 | ('cell_size', c_uint32), |
---|
| 123 | ('values', POINTER(REGFI_VALUE_LIST)), |
---|
| 124 | ('subkeys', POINTER(REGFI_SUBKEY_LIST)), |
---|
| 125 | ('flags', c_uint16), |
---|
| 126 | ('magic', c_char * 2), |
---|
| 127 | ('mtime', REGFI_NTTIME), |
---|
| 128 | ('name_length', c_uint16), |
---|
| 129 | ('classname_length', c_uint16), |
---|
[206] | 130 | ('name', c_char_p), |
---|
| 131 | ('name_raw', POINTER(c_char)), |
---|
[205] | 132 | ('parent_off', c_uint32), |
---|
| 133 | ('classname_off', c_uint32), |
---|
| 134 | ('max_bytes_subkeyname', c_uint32), |
---|
| 135 | ('max_bytes_subkeyclassname', c_uint32), |
---|
| 136 | ('max_bytes_valuename', c_uint32), |
---|
| 137 | ('max_bytes_value', c_uint32), |
---|
| 138 | ('unknown1', c_uint32), |
---|
| 139 | ('unknown2', c_uint32), |
---|
| 140 | ('unknown3', c_uint32), |
---|
| 141 | ('unk_index', c_uint32), |
---|
| 142 | ('num_subkeys', c_uint32), |
---|
| 143 | ('subkeys_off', c_uint32), |
---|
| 144 | ('num_values', c_uint32), |
---|
| 145 | ('values_off', c_uint32), |
---|
| 146 | ('sk_off', c_uint32), |
---|
| 147 | ] |
---|
| 148 | |
---|
| 149 | |
---|
| 150 | REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32), |
---|
| 151 | ('cell_size', c_uint32), |
---|
| 152 | ('num_children', c_uint32), |
---|
| 153 | ('num_keys', c_uint32), |
---|
| 154 | ('elements', c_void_p), |
---|
| 155 | ('magic', c_char * 2), |
---|
| 156 | ('recursive_type', c_bool), |
---|
| 157 | ] |
---|
| 158 | |
---|
| 159 | |
---|
| 160 | REGFI_VALUE_LIST._fields_ = [('offset', c_uint32), |
---|
| 161 | ('cell_size', c_uint32), |
---|
| 162 | ('num_children', c_uint32), |
---|
| 163 | ('num_values', c_uint32), |
---|
| 164 | ('elements', c_void_p), |
---|
| 165 | ] |
---|
| 166 | |
---|
| 167 | REGFI_CLASSNAME._fields_ = [('offset', c_uint32), |
---|
| 168 | ('interpreted', c_char_p), |
---|
| 169 | ('raw', POINTER(c_char)), |
---|
| 170 | ('size', c_uint16), |
---|
| 171 | ] |
---|
| 172 | |
---|
| 173 | |
---|
| 174 | class REGFI_DATA__interpreted(Union): |
---|
| 175 | _fields_ = [('none',POINTER(c_char)), |
---|
| 176 | ('string', c_char_p), |
---|
| 177 | ('expand_string', c_char_p), |
---|
| 178 | ('binary',POINTER(c_char)), |
---|
| 179 | ('dword', c_uint32), |
---|
| 180 | ('dword_be', c_uint32), |
---|
| 181 | ('link', c_char_p), |
---|
| 182 | ('multiple_string', POINTER(c_char_p)), |
---|
| 183 | ('qword', c_uint64), |
---|
| 184 | ('resource_list',POINTER(c_char)), |
---|
| 185 | ('full_resource_descriptor',POINTER(c_char)), |
---|
| 186 | ('resource_requirements_list',POINTER(c_char)), |
---|
[209] | 187 | ] |
---|
[205] | 188 | REGFI_DATA._fields_ = [('offset', c_uint32), |
---|
| 189 | ('type', REGFI_DATA_TYPE), |
---|
| 190 | ('size', c_uint32), |
---|
| 191 | ('raw', POINTER(c_char)), |
---|
| 192 | ('interpreted_size', c_uint32), |
---|
| 193 | ('interpreted', REGFI_DATA__interpreted), |
---|
| 194 | ] |
---|
| 195 | |
---|
[209] | 196 | |
---|
[205] | 197 | REGFI_FILE._fields_ = [('magic', c_char * 4), |
---|
| 198 | ('sequence1', c_uint32), |
---|
| 199 | ('sequence2', c_uint32), |
---|
| 200 | ('mtime', REGFI_NTTIME), |
---|
| 201 | ('major_version', c_uint32), |
---|
| 202 | ('minor_version', c_uint32), |
---|
| 203 | ('type', c_uint32), |
---|
| 204 | ('format', c_uint32), |
---|
| 205 | ('root_cell', c_uint32), |
---|
| 206 | ('last_block', c_uint32), |
---|
| 207 | ('cluster', c_uint32), |
---|
| 208 | ] |
---|
| 209 | |
---|
| 210 | |
---|
[204] | 211 | REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type), |
---|
| 212 | ('read', read_cb_type), |
---|
| 213 | ('cur_off', c_uint64), |
---|
| 214 | ('size', c_uint64), |
---|
| 215 | ('state', c_void_p), |
---|
| 216 | ] |
---|
[220] | 217 | |
---|
| 218 | |
---|
| 219 | # Load libregfi and define function prototypes |
---|
| 220 | regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True) |
---|
| 221 | |
---|
| 222 | regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING] |
---|
| 223 | regfi.regfi_alloc.restype = POINTER(REGFI_FILE) |
---|
| 224 | |
---|
| 225 | regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING] |
---|
| 226 | regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE) |
---|
| 227 | |
---|
| 228 | regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)] |
---|
| 229 | regfi.regfi_free.restype = None |
---|
| 230 | |
---|
| 231 | regfi.regfi_log_get_str.argtypes = [] |
---|
| 232 | regfi.regfi_log_get_str.restype = c_char_p |
---|
| 233 | |
---|
| 234 | regfi.regfi_log_set_mask.argtypes = [c_uint16] |
---|
| 235 | regfi.regfi_log_set_mask.restype = c_bool |
---|
| 236 | |
---|
| 237 | regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)] |
---|
| 238 | regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK) |
---|
| 239 | |
---|
| 240 | regfi.regfi_free_record.argtypes = [c_void_p] |
---|
| 241 | regfi.regfi_free_record.restype = None |
---|
| 242 | |
---|
| 243 | regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)] |
---|
| 244 | regfi.regfi_fetch_num_subkeys.restype = c_uint32 |
---|
| 245 | |
---|
| 246 | regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)] |
---|
| 247 | regfi.regfi_fetch_num_values.restype = c_uint32 |
---|
| 248 | |
---|
| 249 | regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 250 | regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME) |
---|
| 251 | |
---|
| 252 | regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 253 | regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK) |
---|
| 254 | |
---|
| 255 | regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)] |
---|
| 256 | regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA) |
---|
| 257 | |
---|
| 258 | regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 259 | c_char_p, POINTER(c_uint32)] |
---|
| 260 | regfi.regfi_find_subkey.restype = c_bool |
---|
| 261 | |
---|
| 262 | regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 263 | c_char_p, POINTER(c_uint32)] |
---|
| 264 | regfi.regfi_find_value.restype = c_bool |
---|
| 265 | |
---|
| 266 | regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 267 | c_uint32] |
---|
| 268 | regfi.regfi_get_subkey.restype = POINTER(REGFI_NK) |
---|
| 269 | |
---|
| 270 | regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 271 | c_uint32] |
---|
| 272 | regfi.regfi_get_value.restype = POINTER(REGFI_VK) |
---|
| 273 | |
---|
| 274 | regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 275 | regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK) |
---|
| 276 | |
---|
| 277 | regfi.regfi_nt2unix_time.argtypes = [POINTER(REGFI_NTTIME)] |
---|
| 278 | regfi.regfi_nt2unix_time.restype = c_double |
---|
| 279 | |
---|
| 280 | regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE), REGFI_ENCODING] |
---|
| 281 | regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR) |
---|
| 282 | |
---|
| 283 | regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 284 | regfi.regfi_iterator_free.restype = None |
---|
| 285 | |
---|
| 286 | regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 287 | regfi.regfi_iterator_down.restype = c_bool |
---|
| 288 | |
---|
| 289 | regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 290 | regfi.regfi_iterator_up.restype = c_bool |
---|
| 291 | |
---|
| 292 | regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 293 | regfi.regfi_iterator_to_root.restype = c_bool |
---|
| 294 | |
---|
| 295 | regfi.regfi_iterator_walk_path.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 296 | regfi.regfi_iterator_walk_path.restype = c_bool |
---|
| 297 | |
---|
| 298 | regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 299 | regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK) |
---|
| 300 | |
---|
| 301 | regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 302 | regfi.regfi_iterator_first_subkey.restype = c_bool |
---|
| 303 | |
---|
| 304 | regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 305 | regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK) |
---|
| 306 | |
---|
| 307 | regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 308 | regfi.regfi_iterator_next_subkey.restype = c_bool |
---|
| 309 | |
---|
| 310 | regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
| 311 | regfi.regfi_iterator_find_subkey.restype = c_bool |
---|
| 312 | |
---|
| 313 | regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 314 | regfi.regfi_iterator_first_value.restype = c_bool |
---|
| 315 | |
---|
| 316 | regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 317 | regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK) |
---|
| 318 | |
---|
| 319 | regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 320 | regfi.regfi_iterator_next_value.restype = c_bool |
---|
| 321 | |
---|
| 322 | regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
| 323 | regfi.regfi_iterator_find_value.restype = c_bool |
---|
| 324 | |
---|
| 325 | |
---|
| 326 | regfi.regfi_init.argtypes = [] |
---|
| 327 | regfi.regfi_init.restype = None |
---|
| 328 | regfi.regfi_init() |
---|