| [204] | 1 | #!/usr/bin/env python |
|---|
| 2 | |
|---|
| [261] | 3 | # Copyright (C) 2010-2011 Timothy D. Morgan |
|---|
| 4 | # |
|---|
| 5 | # This program is free software; you can redistribute it and/or modify |
|---|
| 6 | # it under the terms of the GNU General Public License as published by |
|---|
| 7 | # the Free Software Foundation; version 3 of the License. |
|---|
| 8 | # |
|---|
| 9 | # This program is distributed in the hope that it will be useful, |
|---|
| 10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 12 | # GNU General Public License for more details. |
|---|
| 13 | # |
|---|
| 14 | # You should have received a copy of the GNU General Public License |
|---|
| 15 | # along with this program; if not, write to the Free Software |
|---|
| 16 | # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
|---|
| 17 | # |
|---|
| 18 | # $Id: $ |
|---|
| 19 | |
|---|
| [221] | 20 | ## @package pyregfi.structures |
|---|
| 21 | # Low-level data structures and C API mappings. |
|---|
| 22 | # |
|---|
| 23 | # Most users need not venture here. For more information, see the source. |
|---|
| 24 | |
|---|
| [204] | 25 | import sys |
|---|
| 26 | import os |
|---|
| 27 | import traceback |
|---|
| 28 | import ctypes |
|---|
| 29 | import ctypes.util |
|---|
| [205] | 30 | from ctypes import * |
|---|
| [204] | 31 | |
|---|
| [226] | 32 | is_win32 = hasattr(ctypes, 'windll') |
|---|
| [221] | 33 | |
|---|
| [205] | 34 | # XXX: can we always be sure enums are this size? |
|---|
| 35 | REGFI_ENCODING = c_uint32 |
|---|
| [227] | 36 | REGFI_ENCODING_UTF8 = REGFI_ENCODING(1) |
|---|
| [213] | 37 | |
|---|
| [268] | 38 | REGFI_NK_FLAG_ASCIINAME = 0x0020 |
|---|
| 39 | REGFI_VK_FLAG_ASCIINAME = 0x0001 |
|---|
| 40 | |
|---|
| [205] | 41 | REGFI_DATA_TYPE = c_uint32 |
|---|
| [252] | 42 | REGFI_NTTIME = c_uint64 |
|---|
| [204] | 43 | |
|---|
| [253] | 44 | REGFI_REGF_SIZE = 0x1000 |
|---|
| 45 | |
|---|
| [205] | 46 | # Prototype everything first so we don't have to worry about reference order |
|---|
| 47 | class REGFI_VK(Structure): |
|---|
| 48 | pass |
|---|
| 49 | |
|---|
| 50 | class REGFI_SK(Structure): |
|---|
| 51 | pass |
|---|
| 52 | |
|---|
| 53 | class REGFI_SUBKEY_LIST(Structure): |
|---|
| 54 | pass |
|---|
| 55 | |
|---|
| 56 | class REGFI_VALUE_LIST(Structure): |
|---|
| 57 | pass |
|---|
| 58 | |
|---|
| 59 | class REGFI_CLASSNAME(Structure): |
|---|
| 60 | pass |
|---|
| 61 | |
|---|
| 62 | class REGFI_DATA(Structure): |
|---|
| 63 | pass |
|---|
| 64 | |
|---|
| 65 | class REGFI_NK(Structure): |
|---|
| 66 | pass |
|---|
| 67 | |
|---|
| 68 | class REGFI_ITERATOR(Structure): |
|---|
| 69 | pass |
|---|
| 70 | |
|---|
| 71 | class REGFI_FILE(Structure): |
|---|
| 72 | pass |
|---|
| 73 | |
|---|
| 74 | class REGFI_RAW_FILE(Structure): |
|---|
| [204] | 75 | fh = None |
|---|
| 76 | |
|---|
| 77 | def cb_seek(self, raw_file, offset, whence): |
|---|
| 78 | try: |
|---|
| 79 | self.fh.seek(offset, whence) |
|---|
| 80 | except Exception: |
|---|
| 81 | traceback.print_exc() |
|---|
| [226] | 82 | set_errno(74) # os.EX_IOERR |
|---|
| [204] | 83 | return -1 |
|---|
| 84 | |
|---|
| 85 | return self.fh.tell() |
|---|
| 86 | |
|---|
| 87 | |
|---|
| 88 | def cb_read(self, raw_file, buf, count): |
|---|
| 89 | try: |
|---|
| 90 | # XXX: anyway to do a readinto() here? |
|---|
| 91 | tmp = self.fh.read(count) |
|---|
| [205] | 92 | memmove(buf,tmp,len(tmp)) |
|---|
| [204] | 93 | |
|---|
| 94 | except Exception: |
|---|
| 95 | traceback.print_exc() |
|---|
| [226] | 96 | set_errno(74) # os.EX_IOERR |
|---|
| [204] | 97 | return -1 |
|---|
| 98 | return len(tmp) |
|---|
| 99 | |
|---|
| 100 | |
|---|
| [225] | 101 | # Load libregfi according to platform |
|---|
| 102 | regfi = None |
|---|
| [226] | 103 | if is_win32: |
|---|
| 104 | # XXX: Using C calling conventions on cross-compiled DLLs seems to work fine |
|---|
| 105 | # on Windows, but I'm not sure if stdcall symbols are supported |
|---|
| 106 | # correctly for native Windows binaries... |
|---|
| [225] | 107 | #regfi = ctypes.windll.libregfi |
|---|
| [226] | 108 | #CB_FACTORY = ctypes.WINFUNCTYPE |
|---|
| 109 | regfi = ctypes.CDLL('libregfi.dll', use_errno=True) |
|---|
| 110 | CB_FACTORY = ctypes.CFUNCTYPE |
|---|
| [225] | 111 | else: |
|---|
| 112 | regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True) |
|---|
| 113 | CB_FACTORY = ctypes.CFUNCTYPE |
|---|
| [204] | 114 | |
|---|
| [226] | 115 | seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True) |
|---|
| 116 | read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t, use_errno=True) |
|---|
| [204] | 117 | |
|---|
| [225] | 118 | |
|---|
| [255] | 119 | from .winsec import * |
|---|
| [253] | 120 | |
|---|
| [205] | 121 | REGFI_VK._fields_ = [('offset', c_uint32), |
|---|
| 122 | ('cell_size', c_uint32), |
|---|
| [206] | 123 | ('name', c_char_p), |
|---|
| 124 | ('name_raw', POINTER(c_char)), |
|---|
| [205] | 125 | ('name_length', c_uint16), |
|---|
| 126 | ('hbin_off', c_uint32), |
|---|
| 127 | ('data_size', c_uint32), |
|---|
| 128 | ('data_off', c_uint32), |
|---|
| 129 | ('type', REGFI_DATA_TYPE), |
|---|
| 130 | ('magic', c_char * 2), |
|---|
| 131 | ('flags', c_uint16), |
|---|
| 132 | ('unknown1', c_uint16), |
|---|
| 133 | ('data_in_offset', c_bool), |
|---|
| 134 | ] |
|---|
| 135 | |
|---|
| 136 | |
|---|
| 137 | REGFI_SK._fields_ = [('offset', c_uint32), |
|---|
| 138 | ('cell_size', c_uint32), |
|---|
| [253] | 139 | ('sec_desc', POINTER(WINSEC_DESC)), |
|---|
| [205] | 140 | ('hbin_off', c_uint32), |
|---|
| 141 | ('prev_sk_off', c_uint32), |
|---|
| 142 | ('next_sk_off', c_uint32), |
|---|
| 143 | ('ref_count', c_uint32), |
|---|
| 144 | ('desc_size', c_uint32), |
|---|
| 145 | ('unknown_tag', c_uint16), |
|---|
| 146 | ('magic', c_char * 2), |
|---|
| 147 | ] |
|---|
| 148 | |
|---|
| 149 | |
|---|
| 150 | REGFI_NK._fields_ = [('offset', c_uint32), |
|---|
| 151 | ('cell_size', c_uint32), |
|---|
| 152 | ('values', POINTER(REGFI_VALUE_LIST)), |
|---|
| 153 | ('subkeys', POINTER(REGFI_SUBKEY_LIST)), |
|---|
| 154 | ('flags', c_uint16), |
|---|
| 155 | ('magic', c_char * 2), |
|---|
| 156 | ('mtime', REGFI_NTTIME), |
|---|
| 157 | ('name_length', c_uint16), |
|---|
| 158 | ('classname_length', c_uint16), |
|---|
| [206] | 159 | ('name', c_char_p), |
|---|
| 160 | ('name_raw', POINTER(c_char)), |
|---|
| [205] | 161 | ('parent_off', c_uint32), |
|---|
| 162 | ('classname_off', c_uint32), |
|---|
| 163 | ('max_bytes_subkeyname', c_uint32), |
|---|
| 164 | ('max_bytes_subkeyclassname', c_uint32), |
|---|
| 165 | ('max_bytes_valuename', c_uint32), |
|---|
| 166 | ('max_bytes_value', c_uint32), |
|---|
| 167 | ('unknown1', c_uint32), |
|---|
| 168 | ('unknown2', c_uint32), |
|---|
| 169 | ('unknown3', c_uint32), |
|---|
| 170 | ('unk_index', c_uint32), |
|---|
| 171 | ('num_subkeys', c_uint32), |
|---|
| 172 | ('subkeys_off', c_uint32), |
|---|
| 173 | ('num_values', c_uint32), |
|---|
| 174 | ('values_off', c_uint32), |
|---|
| 175 | ('sk_off', c_uint32), |
|---|
| 176 | ] |
|---|
| 177 | |
|---|
| 178 | |
|---|
| 179 | REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32), |
|---|
| 180 | ('cell_size', c_uint32), |
|---|
| 181 | ('num_children', c_uint32), |
|---|
| 182 | ('num_keys', c_uint32), |
|---|
| 183 | ('elements', c_void_p), |
|---|
| 184 | ('magic', c_char * 2), |
|---|
| 185 | ('recursive_type', c_bool), |
|---|
| 186 | ] |
|---|
| 187 | |
|---|
| 188 | |
|---|
| 189 | REGFI_VALUE_LIST._fields_ = [('offset', c_uint32), |
|---|
| 190 | ('cell_size', c_uint32), |
|---|
| 191 | ('num_values', c_uint32), |
|---|
| 192 | ('elements', c_void_p), |
|---|
| 193 | ] |
|---|
| 194 | |
|---|
| 195 | REGFI_CLASSNAME._fields_ = [('offset', c_uint32), |
|---|
| 196 | ('interpreted', c_char_p), |
|---|
| 197 | ('raw', POINTER(c_char)), |
|---|
| 198 | ('size', c_uint16), |
|---|
| 199 | ] |
|---|
| 200 | |
|---|
| 201 | |
|---|
| 202 | class REGFI_DATA__interpreted(Union): |
|---|
| 203 | _fields_ = [('none',POINTER(c_char)), |
|---|
| 204 | ('string', c_char_p), |
|---|
| 205 | ('expand_string', c_char_p), |
|---|
| 206 | ('binary',POINTER(c_char)), |
|---|
| 207 | ('dword', c_uint32), |
|---|
| 208 | ('dword_be', c_uint32), |
|---|
| 209 | ('link', c_char_p), |
|---|
| 210 | ('multiple_string', POINTER(c_char_p)), |
|---|
| 211 | ('qword', c_uint64), |
|---|
| 212 | ('resource_list',POINTER(c_char)), |
|---|
| 213 | ('full_resource_descriptor',POINTER(c_char)), |
|---|
| 214 | ('resource_requirements_list',POINTER(c_char)), |
|---|
| [209] | 215 | ] |
|---|
| [205] | 216 | REGFI_DATA._fields_ = [('offset', c_uint32), |
|---|
| 217 | ('type', REGFI_DATA_TYPE), |
|---|
| 218 | ('size', c_uint32), |
|---|
| 219 | ('raw', POINTER(c_char)), |
|---|
| 220 | ('interpreted_size', c_uint32), |
|---|
| 221 | ('interpreted', REGFI_DATA__interpreted), |
|---|
| 222 | ] |
|---|
| 223 | |
|---|
| [209] | 224 | |
|---|
| [205] | 225 | REGFI_FILE._fields_ = [('magic', c_char * 4), |
|---|
| 226 | ('sequence1', c_uint32), |
|---|
| 227 | ('sequence2', c_uint32), |
|---|
| 228 | ('mtime', REGFI_NTTIME), |
|---|
| 229 | ('major_version', c_uint32), |
|---|
| 230 | ('minor_version', c_uint32), |
|---|
| 231 | ('type', c_uint32), |
|---|
| 232 | ('format', c_uint32), |
|---|
| 233 | ('root_cell', c_uint32), |
|---|
| 234 | ('last_block', c_uint32), |
|---|
| 235 | ('cluster', c_uint32), |
|---|
| 236 | ] |
|---|
| 237 | |
|---|
| 238 | |
|---|
| [204] | 239 | REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type), |
|---|
| 240 | ('read', read_cb_type), |
|---|
| 241 | ('cur_off', c_uint64), |
|---|
| 242 | ('size', c_uint64), |
|---|
| 243 | ('state', c_void_p), |
|---|
| 244 | ] |
|---|
| [220] | 245 | |
|---|
| 246 | |
|---|
| [225] | 247 | # Define function prototypes |
|---|
| [233] | 248 | regfi.regfi_version.argtypes = [] |
|---|
| 249 | regfi.regfi_version.restype = c_char_p |
|---|
| 250 | |
|---|
| [220] | 251 | regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING] |
|---|
| 252 | regfi.regfi_alloc.restype = POINTER(REGFI_FILE) |
|---|
| 253 | |
|---|
| 254 | regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING] |
|---|
| 255 | regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE) |
|---|
| 256 | |
|---|
| 257 | regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)] |
|---|
| 258 | regfi.regfi_free.restype = None |
|---|
| 259 | |
|---|
| 260 | regfi.regfi_log_get_str.argtypes = [] |
|---|
| 261 | regfi.regfi_log_get_str.restype = c_char_p |
|---|
| 262 | |
|---|
| 263 | regfi.regfi_log_set_mask.argtypes = [c_uint16] |
|---|
| 264 | regfi.regfi_log_set_mask.restype = c_bool |
|---|
| 265 | |
|---|
| 266 | regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)] |
|---|
| 267 | regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK) |
|---|
| 268 | |
|---|
| [228] | 269 | regfi.regfi_free_record.argtypes = [POINTER(REGFI_FILE), c_void_p] |
|---|
| [220] | 270 | regfi.regfi_free_record.restype = None |
|---|
| 271 | |
|---|
| [228] | 272 | regfi.regfi_reference_record.argtypes = [POINTER(REGFI_FILE), c_void_p] |
|---|
| [252] | 273 | regfi.regfi_reference_record.restype = c_void_p |
|---|
| [224] | 274 | |
|---|
| [220] | 275 | regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)] |
|---|
| 276 | regfi.regfi_fetch_num_subkeys.restype = c_uint32 |
|---|
| 277 | |
|---|
| 278 | regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)] |
|---|
| 279 | regfi.regfi_fetch_num_values.restype = c_uint32 |
|---|
| 280 | |
|---|
| 281 | regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
|---|
| 282 | regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME) |
|---|
| 283 | |
|---|
| 284 | regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
|---|
| 285 | regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK) |
|---|
| 286 | |
|---|
| [253] | 287 | regfi.regfi_next_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)] |
|---|
| 288 | regfi.regfi_next_sk.restype = POINTER(REGFI_SK) |
|---|
| 289 | |
|---|
| 290 | regfi.regfi_prev_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)] |
|---|
| 291 | regfi.regfi_prev_sk.restype = POINTER(REGFI_SK) |
|---|
| 292 | |
|---|
| [220] | 293 | regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)] |
|---|
| 294 | regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA) |
|---|
| 295 | |
|---|
| 296 | regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
|---|
| 297 | c_char_p, POINTER(c_uint32)] |
|---|
| 298 | regfi.regfi_find_subkey.restype = c_bool |
|---|
| 299 | |
|---|
| 300 | regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
|---|
| [256] | 301 | c_char_p, POINTER(c_uint32)] |
|---|
| [220] | 302 | regfi.regfi_find_value.restype = c_bool |
|---|
| 303 | |
|---|
| 304 | regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
|---|
| 305 | c_uint32] |
|---|
| 306 | regfi.regfi_get_subkey.restype = POINTER(REGFI_NK) |
|---|
| 307 | |
|---|
| 308 | regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
|---|
| [256] | 309 | c_uint32] |
|---|
| [220] | 310 | regfi.regfi_get_value.restype = POINTER(REGFI_VK) |
|---|
| 311 | |
|---|
| 312 | regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
|---|
| 313 | regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK) |
|---|
| 314 | |
|---|
| [253] | 315 | regfi.regfi_nt2unix_time.argtypes = [REGFI_NTTIME] |
|---|
| [220] | 316 | regfi.regfi_nt2unix_time.restype = c_double |
|---|
| 317 | |
|---|
| [228] | 318 | regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE)] |
|---|
| [220] | 319 | regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR) |
|---|
| 320 | |
|---|
| 321 | regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 322 | regfi.regfi_iterator_free.restype = None |
|---|
| 323 | |
|---|
| 324 | regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 325 | regfi.regfi_iterator_down.restype = c_bool |
|---|
| 326 | |
|---|
| 327 | regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 328 | regfi.regfi_iterator_up.restype = c_bool |
|---|
| 329 | |
|---|
| 330 | regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 331 | regfi.regfi_iterator_to_root.restype = c_bool |
|---|
| 332 | |
|---|
| [252] | 333 | regfi.regfi_iterator_descend.argtypes = [POINTER(REGFI_ITERATOR), POINTER(c_char_p)] |
|---|
| 334 | regfi.regfi_iterator_descend.restype = c_bool |
|---|
| [220] | 335 | |
|---|
| 336 | regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 337 | regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK) |
|---|
| 338 | |
|---|
| 339 | regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 340 | regfi.regfi_iterator_first_subkey.restype = c_bool |
|---|
| 341 | |
|---|
| 342 | regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 343 | regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK) |
|---|
| 344 | |
|---|
| 345 | regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 346 | regfi.regfi_iterator_next_subkey.restype = c_bool |
|---|
| 347 | |
|---|
| 348 | regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
|---|
| 349 | regfi.regfi_iterator_find_subkey.restype = c_bool |
|---|
| 350 | |
|---|
| 351 | regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 352 | regfi.regfi_iterator_first_value.restype = c_bool |
|---|
| 353 | |
|---|
| 354 | regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 355 | regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK) |
|---|
| 356 | |
|---|
| 357 | regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 358 | regfi.regfi_iterator_next_value.restype = c_bool |
|---|
| 359 | |
|---|
| 360 | regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
|---|
| 361 | regfi.regfi_iterator_find_value.restype = c_bool |
|---|
| 362 | |
|---|
| [252] | 363 | regfi.regfi_iterator_ancestry.argtypes = [POINTER(REGFI_ITERATOR)] |
|---|
| 364 | regfi.regfi_iterator_ancestry.restype = POINTER(POINTER(REGFI_NK)) |
|---|
| [220] | 365 | |
|---|
| 366 | regfi.regfi_init.argtypes = [] |
|---|
| 367 | regfi.regfi_init.restype = None |
|---|
| 368 | regfi.regfi_init() |
|---|
