[204] | 1 | #!/usr/bin/env python |
---|
| 2 | |
---|
[261] | 3 | # Copyright (C) 2010-2011 Timothy D. Morgan |
---|
| 4 | # |
---|
| 5 | # This program is free software; you can redistribute it and/or modify |
---|
| 6 | # it under the terms of the GNU General Public License as published by |
---|
| 7 | # the Free Software Foundation; version 3 of the License. |
---|
| 8 | # |
---|
| 9 | # This program is distributed in the hope that it will be useful, |
---|
| 10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 12 | # GNU General Public License for more details. |
---|
| 13 | # |
---|
| 14 | # You should have received a copy of the GNU General Public License |
---|
| 15 | # along with this program; if not, write to the Free Software |
---|
| 16 | # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
| 17 | # |
---|
| 18 | # $Id: $ |
---|
| 19 | |
---|
[221] | 20 | ## @package pyregfi.structures |
---|
| 21 | # Low-level data structures and C API mappings. |
---|
| 22 | # |
---|
| 23 | # Most users need not venture here. For more information, see the source. |
---|
| 24 | |
---|
[204] | 25 | import sys |
---|
| 26 | import os |
---|
| 27 | import traceback |
---|
| 28 | import ctypes |
---|
| 29 | import ctypes.util |
---|
[205] | 30 | from ctypes import * |
---|
[204] | 31 | |
---|
[226] | 32 | is_win32 = hasattr(ctypes, 'windll') |
---|
[221] | 33 | |
---|
[205] | 34 | # XXX: can we always be sure enums are this size? |
---|
| 35 | REGFI_ENCODING = c_uint32 |
---|
[227] | 36 | REGFI_ENCODING_UTF8 = REGFI_ENCODING(1) |
---|
[213] | 37 | |
---|
[205] | 38 | REGFI_DATA_TYPE = c_uint32 |
---|
[252] | 39 | REGFI_NTTIME = c_uint64 |
---|
[204] | 40 | |
---|
[253] | 41 | REGFI_REGF_SIZE = 0x1000 |
---|
| 42 | |
---|
[205] | 43 | # Prototype everything first so we don't have to worry about reference order |
---|
| 44 | class REGFI_VK(Structure): |
---|
| 45 | pass |
---|
| 46 | |
---|
| 47 | class REGFI_SK(Structure): |
---|
| 48 | pass |
---|
| 49 | |
---|
| 50 | class REGFI_SUBKEY_LIST(Structure): |
---|
| 51 | pass |
---|
| 52 | |
---|
| 53 | class REGFI_VALUE_LIST(Structure): |
---|
| 54 | pass |
---|
| 55 | |
---|
| 56 | class REGFI_CLASSNAME(Structure): |
---|
| 57 | pass |
---|
| 58 | |
---|
| 59 | class REGFI_DATA(Structure): |
---|
| 60 | pass |
---|
| 61 | |
---|
| 62 | class REGFI_NK(Structure): |
---|
| 63 | pass |
---|
| 64 | |
---|
| 65 | class REGFI_ITERATOR(Structure): |
---|
| 66 | pass |
---|
| 67 | |
---|
| 68 | class REGFI_FILE(Structure): |
---|
| 69 | pass |
---|
| 70 | |
---|
| 71 | class REGFI_RAW_FILE(Structure): |
---|
[204] | 72 | fh = None |
---|
| 73 | |
---|
| 74 | def cb_seek(self, raw_file, offset, whence): |
---|
| 75 | try: |
---|
| 76 | self.fh.seek(offset, whence) |
---|
| 77 | except Exception: |
---|
| 78 | traceback.print_exc() |
---|
[226] | 79 | set_errno(74) # os.EX_IOERR |
---|
[204] | 80 | return -1 |
---|
| 81 | |
---|
| 82 | return self.fh.tell() |
---|
| 83 | |
---|
| 84 | |
---|
| 85 | def cb_read(self, raw_file, buf, count): |
---|
| 86 | try: |
---|
| 87 | # XXX: anyway to do a readinto() here? |
---|
| 88 | tmp = self.fh.read(count) |
---|
[205] | 89 | memmove(buf,tmp,len(tmp)) |
---|
[204] | 90 | |
---|
| 91 | except Exception: |
---|
| 92 | traceback.print_exc() |
---|
[226] | 93 | set_errno(74) # os.EX_IOERR |
---|
[204] | 94 | return -1 |
---|
| 95 | return len(tmp) |
---|
| 96 | |
---|
| 97 | |
---|
[225] | 98 | # Load libregfi according to platform |
---|
| 99 | regfi = None |
---|
[226] | 100 | if is_win32: |
---|
| 101 | # XXX: Using C calling conventions on cross-compiled DLLs seems to work fine |
---|
| 102 | # on Windows, but I'm not sure if stdcall symbols are supported |
---|
| 103 | # correctly for native Windows binaries... |
---|
[225] | 104 | #regfi = ctypes.windll.libregfi |
---|
[226] | 105 | #CB_FACTORY = ctypes.WINFUNCTYPE |
---|
| 106 | regfi = ctypes.CDLL('libregfi.dll', use_errno=True) |
---|
| 107 | CB_FACTORY = ctypes.CFUNCTYPE |
---|
[225] | 108 | else: |
---|
| 109 | regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True) |
---|
| 110 | CB_FACTORY = ctypes.CFUNCTYPE |
---|
[204] | 111 | |
---|
[226] | 112 | seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True) |
---|
| 113 | read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t, use_errno=True) |
---|
[204] | 114 | |
---|
[225] | 115 | |
---|
[255] | 116 | from .winsec import * |
---|
[253] | 117 | |
---|
[205] | 118 | REGFI_VK._fields_ = [('offset', c_uint32), |
---|
| 119 | ('cell_size', c_uint32), |
---|
[206] | 120 | ('name', c_char_p), |
---|
| 121 | ('name_raw', POINTER(c_char)), |
---|
[205] | 122 | ('name_length', c_uint16), |
---|
| 123 | ('hbin_off', c_uint32), |
---|
| 124 | ('data_size', c_uint32), |
---|
| 125 | ('data_off', c_uint32), |
---|
| 126 | ('type', REGFI_DATA_TYPE), |
---|
| 127 | ('magic', c_char * 2), |
---|
| 128 | ('flags', c_uint16), |
---|
| 129 | ('unknown1', c_uint16), |
---|
| 130 | ('data_in_offset', c_bool), |
---|
| 131 | ] |
---|
| 132 | |
---|
| 133 | |
---|
| 134 | REGFI_SK._fields_ = [('offset', c_uint32), |
---|
| 135 | ('cell_size', c_uint32), |
---|
[253] | 136 | ('sec_desc', POINTER(WINSEC_DESC)), |
---|
[205] | 137 | ('hbin_off', c_uint32), |
---|
| 138 | ('prev_sk_off', c_uint32), |
---|
| 139 | ('next_sk_off', c_uint32), |
---|
| 140 | ('ref_count', c_uint32), |
---|
| 141 | ('desc_size', c_uint32), |
---|
| 142 | ('unknown_tag', c_uint16), |
---|
| 143 | ('magic', c_char * 2), |
---|
| 144 | ] |
---|
| 145 | |
---|
| 146 | |
---|
| 147 | REGFI_NK._fields_ = [('offset', c_uint32), |
---|
| 148 | ('cell_size', c_uint32), |
---|
| 149 | ('values', POINTER(REGFI_VALUE_LIST)), |
---|
| 150 | ('subkeys', POINTER(REGFI_SUBKEY_LIST)), |
---|
| 151 | ('flags', c_uint16), |
---|
| 152 | ('magic', c_char * 2), |
---|
| 153 | ('mtime', REGFI_NTTIME), |
---|
| 154 | ('name_length', c_uint16), |
---|
| 155 | ('classname_length', c_uint16), |
---|
[206] | 156 | ('name', c_char_p), |
---|
| 157 | ('name_raw', POINTER(c_char)), |
---|
[205] | 158 | ('parent_off', c_uint32), |
---|
| 159 | ('classname_off', c_uint32), |
---|
| 160 | ('max_bytes_subkeyname', c_uint32), |
---|
| 161 | ('max_bytes_subkeyclassname', c_uint32), |
---|
| 162 | ('max_bytes_valuename', c_uint32), |
---|
| 163 | ('max_bytes_value', c_uint32), |
---|
| 164 | ('unknown1', c_uint32), |
---|
| 165 | ('unknown2', c_uint32), |
---|
| 166 | ('unknown3', c_uint32), |
---|
| 167 | ('unk_index', c_uint32), |
---|
| 168 | ('num_subkeys', c_uint32), |
---|
| 169 | ('subkeys_off', c_uint32), |
---|
| 170 | ('num_values', c_uint32), |
---|
| 171 | ('values_off', c_uint32), |
---|
| 172 | ('sk_off', c_uint32), |
---|
| 173 | ] |
---|
| 174 | |
---|
| 175 | |
---|
| 176 | REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32), |
---|
| 177 | ('cell_size', c_uint32), |
---|
| 178 | ('num_children', c_uint32), |
---|
| 179 | ('num_keys', c_uint32), |
---|
| 180 | ('elements', c_void_p), |
---|
| 181 | ('magic', c_char * 2), |
---|
| 182 | ('recursive_type', c_bool), |
---|
| 183 | ] |
---|
| 184 | |
---|
| 185 | |
---|
| 186 | REGFI_VALUE_LIST._fields_ = [('offset', c_uint32), |
---|
| 187 | ('cell_size', c_uint32), |
---|
| 188 | ('num_values', c_uint32), |
---|
| 189 | ('elements', c_void_p), |
---|
| 190 | ] |
---|
| 191 | |
---|
| 192 | REGFI_CLASSNAME._fields_ = [('offset', c_uint32), |
---|
| 193 | ('interpreted', c_char_p), |
---|
| 194 | ('raw', POINTER(c_char)), |
---|
| 195 | ('size', c_uint16), |
---|
| 196 | ] |
---|
| 197 | |
---|
| 198 | |
---|
| 199 | class REGFI_DATA__interpreted(Union): |
---|
| 200 | _fields_ = [('none',POINTER(c_char)), |
---|
| 201 | ('string', c_char_p), |
---|
| 202 | ('expand_string', c_char_p), |
---|
| 203 | ('binary',POINTER(c_char)), |
---|
| 204 | ('dword', c_uint32), |
---|
| 205 | ('dword_be', c_uint32), |
---|
| 206 | ('link', c_char_p), |
---|
| 207 | ('multiple_string', POINTER(c_char_p)), |
---|
| 208 | ('qword', c_uint64), |
---|
| 209 | ('resource_list',POINTER(c_char)), |
---|
| 210 | ('full_resource_descriptor',POINTER(c_char)), |
---|
| 211 | ('resource_requirements_list',POINTER(c_char)), |
---|
[209] | 212 | ] |
---|
[205] | 213 | REGFI_DATA._fields_ = [('offset', c_uint32), |
---|
| 214 | ('type', REGFI_DATA_TYPE), |
---|
| 215 | ('size', c_uint32), |
---|
| 216 | ('raw', POINTER(c_char)), |
---|
| 217 | ('interpreted_size', c_uint32), |
---|
| 218 | ('interpreted', REGFI_DATA__interpreted), |
---|
| 219 | ] |
---|
| 220 | |
---|
[209] | 221 | |
---|
[205] | 222 | REGFI_FILE._fields_ = [('magic', c_char * 4), |
---|
| 223 | ('sequence1', c_uint32), |
---|
| 224 | ('sequence2', c_uint32), |
---|
| 225 | ('mtime', REGFI_NTTIME), |
---|
| 226 | ('major_version', c_uint32), |
---|
| 227 | ('minor_version', c_uint32), |
---|
| 228 | ('type', c_uint32), |
---|
| 229 | ('format', c_uint32), |
---|
| 230 | ('root_cell', c_uint32), |
---|
| 231 | ('last_block', c_uint32), |
---|
| 232 | ('cluster', c_uint32), |
---|
| 233 | ] |
---|
| 234 | |
---|
| 235 | |
---|
[204] | 236 | REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type), |
---|
| 237 | ('read', read_cb_type), |
---|
| 238 | ('cur_off', c_uint64), |
---|
| 239 | ('size', c_uint64), |
---|
| 240 | ('state', c_void_p), |
---|
| 241 | ] |
---|
[220] | 242 | |
---|
| 243 | |
---|
[225] | 244 | # Define function prototypes |
---|
[233] | 245 | regfi.regfi_version.argtypes = [] |
---|
| 246 | regfi.regfi_version.restype = c_char_p |
---|
| 247 | |
---|
[220] | 248 | regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING] |
---|
| 249 | regfi.regfi_alloc.restype = POINTER(REGFI_FILE) |
---|
| 250 | |
---|
| 251 | regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING] |
---|
| 252 | regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE) |
---|
| 253 | |
---|
| 254 | regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)] |
---|
| 255 | regfi.regfi_free.restype = None |
---|
| 256 | |
---|
| 257 | regfi.regfi_log_get_str.argtypes = [] |
---|
| 258 | regfi.regfi_log_get_str.restype = c_char_p |
---|
| 259 | |
---|
| 260 | regfi.regfi_log_set_mask.argtypes = [c_uint16] |
---|
| 261 | regfi.regfi_log_set_mask.restype = c_bool |
---|
| 262 | |
---|
| 263 | regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)] |
---|
| 264 | regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK) |
---|
| 265 | |
---|
[228] | 266 | regfi.regfi_free_record.argtypes = [POINTER(REGFI_FILE), c_void_p] |
---|
[220] | 267 | regfi.regfi_free_record.restype = None |
---|
| 268 | |
---|
[228] | 269 | regfi.regfi_reference_record.argtypes = [POINTER(REGFI_FILE), c_void_p] |
---|
[252] | 270 | regfi.regfi_reference_record.restype = c_void_p |
---|
[224] | 271 | |
---|
[220] | 272 | regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)] |
---|
| 273 | regfi.regfi_fetch_num_subkeys.restype = c_uint32 |
---|
| 274 | |
---|
| 275 | regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)] |
---|
| 276 | regfi.regfi_fetch_num_values.restype = c_uint32 |
---|
| 277 | |
---|
| 278 | regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 279 | regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME) |
---|
| 280 | |
---|
| 281 | regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 282 | regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK) |
---|
| 283 | |
---|
[253] | 284 | regfi.regfi_next_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)] |
---|
| 285 | regfi.regfi_next_sk.restype = POINTER(REGFI_SK) |
---|
| 286 | |
---|
| 287 | regfi.regfi_prev_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)] |
---|
| 288 | regfi.regfi_prev_sk.restype = POINTER(REGFI_SK) |
---|
| 289 | |
---|
[220] | 290 | regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)] |
---|
| 291 | regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA) |
---|
| 292 | |
---|
| 293 | regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 294 | c_char_p, POINTER(c_uint32)] |
---|
| 295 | regfi.regfi_find_subkey.restype = c_bool |
---|
| 296 | |
---|
| 297 | regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
[256] | 298 | c_char_p, POINTER(c_uint32)] |
---|
[220] | 299 | regfi.regfi_find_value.restype = c_bool |
---|
| 300 | |
---|
| 301 | regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
| 302 | c_uint32] |
---|
| 303 | regfi.regfi_get_subkey.restype = POINTER(REGFI_NK) |
---|
| 304 | |
---|
| 305 | regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
[256] | 306 | c_uint32] |
---|
[220] | 307 | regfi.regfi_get_value.restype = POINTER(REGFI_VK) |
---|
| 308 | |
---|
| 309 | regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
| 310 | regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK) |
---|
| 311 | |
---|
[253] | 312 | regfi.regfi_nt2unix_time.argtypes = [REGFI_NTTIME] |
---|
[220] | 313 | regfi.regfi_nt2unix_time.restype = c_double |
---|
| 314 | |
---|
[228] | 315 | regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE)] |
---|
[220] | 316 | regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR) |
---|
| 317 | |
---|
| 318 | regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 319 | regfi.regfi_iterator_free.restype = None |
---|
| 320 | |
---|
| 321 | regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 322 | regfi.regfi_iterator_down.restype = c_bool |
---|
| 323 | |
---|
| 324 | regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 325 | regfi.regfi_iterator_up.restype = c_bool |
---|
| 326 | |
---|
| 327 | regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 328 | regfi.regfi_iterator_to_root.restype = c_bool |
---|
| 329 | |
---|
[252] | 330 | regfi.regfi_iterator_descend.argtypes = [POINTER(REGFI_ITERATOR), POINTER(c_char_p)] |
---|
| 331 | regfi.regfi_iterator_descend.restype = c_bool |
---|
[220] | 332 | |
---|
| 333 | regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 334 | regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK) |
---|
| 335 | |
---|
| 336 | regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 337 | regfi.regfi_iterator_first_subkey.restype = c_bool |
---|
| 338 | |
---|
| 339 | regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 340 | regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK) |
---|
| 341 | |
---|
| 342 | regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 343 | regfi.regfi_iterator_next_subkey.restype = c_bool |
---|
| 344 | |
---|
| 345 | regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
| 346 | regfi.regfi_iterator_find_subkey.restype = c_bool |
---|
| 347 | |
---|
| 348 | regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 349 | regfi.regfi_iterator_first_value.restype = c_bool |
---|
| 350 | |
---|
| 351 | regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 352 | regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK) |
---|
| 353 | |
---|
| 354 | regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 355 | regfi.regfi_iterator_next_value.restype = c_bool |
---|
| 356 | |
---|
| 357 | regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
| 358 | regfi.regfi_iterator_find_value.restype = c_bool |
---|
| 359 | |
---|
[252] | 360 | regfi.regfi_iterator_ancestry.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
| 361 | regfi.regfi_iterator_ancestry.restype = POINTER(POINTER(REGFI_NK)) |
---|
[220] | 362 | |
---|
| 363 | regfi.regfi_init.argtypes = [] |
---|
| 364 | regfi.regfi_init.restype = None |
---|
| 365 | regfi.regfi_init() |
---|