source: trunk/python/pyregfi/structures.py@ 261

Last change on this file since 261 was 261, checked in by tim, 14 years ago

readded windows file descriptor hack
copyright notices
File size: 12.6 KB
Line 
1#!/usr/bin/env python
2
3# Copyright (C) 2010-2011 Timothy D. Morgan
4#
5# This program is free software; you can redistribute it and/or modify
6# it under the terms of the GNU General Public License as published by
7# the Free Software Foundation; version 3 of the License.
8#
9# This program is distributed in the hope that it will be useful,
10# but WITHOUT ANY WARRANTY; without even the implied warranty of
11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12# GNU General Public License for more details.
13#
14# You should have received a copy of the GNU General Public License
15# along with this program; if not, write to the Free Software
16# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17#
18# $Id: $
19
20## @package pyregfi.structures
21# Low-level data structures and C API mappings.
22#
23# Most users need not venture here. For more information, see the source.
24
25import sys
26import os
27import traceback
28import ctypes
29import ctypes.util
30from ctypes import *
31
32is_win32 = hasattr(ctypes, 'windll')
33
34# XXX: can we always be sure enums are this size?
35REGFI_ENCODING = c_uint32
36REGFI_ENCODING_UTF8 = REGFI_ENCODING(1)
37
38REGFI_DATA_TYPE = c_uint32
39REGFI_NTTIME = c_uint64
40
41REGFI_REGF_SIZE = 0x1000
42
43# Prototype everything first so we don't have to worry about reference order
44class REGFI_VK(Structure):
45 pass
46
47class REGFI_SK(Structure):
48 pass
49
50class REGFI_SUBKEY_LIST(Structure):
51 pass
52
53class REGFI_VALUE_LIST(Structure):
54 pass
55
56class REGFI_CLASSNAME(Structure):
57 pass
58
59class REGFI_DATA(Structure):
60 pass
61
62class REGFI_NK(Structure):
63 pass
64
65class REGFI_ITERATOR(Structure):
66 pass
67
68class REGFI_FILE(Structure):
69 pass
70
71class REGFI_RAW_FILE(Structure):
72 fh = None
73
74 def cb_seek(self, raw_file, offset, whence):
75 try:
76 self.fh.seek(offset, whence)
77 except Exception:
78 traceback.print_exc()
79 set_errno(74) # os.EX_IOERR
80 return -1
81
82 return self.fh.tell()
83
84
85 def cb_read(self, raw_file, buf, count):
86 try:
87 # XXX: anyway to do a readinto() here?
88 tmp = self.fh.read(count)
89 memmove(buf,tmp,len(tmp))
90
91 except Exception:
92 traceback.print_exc()
93 set_errno(74) # os.EX_IOERR
94 return -1
95 return len(tmp)
96
97
98# Load libregfi according to platform
99regfi = None
100if is_win32:
101 # XXX: Using C calling conventions on cross-compiled DLLs seems to work fine
102 # on Windows, but I'm not sure if stdcall symbols are supported
103 # correctly for native Windows binaries...
104 #regfi = ctypes.windll.libregfi
105 #CB_FACTORY = ctypes.WINFUNCTYPE
106 regfi = ctypes.CDLL('libregfi.dll', use_errno=True)
107 CB_FACTORY = ctypes.CFUNCTYPE
108else:
109 regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True)
110 CB_FACTORY = ctypes.CFUNCTYPE
111
112seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True)
113read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t, use_errno=True)
114
115
116from .winsec import *
117
118REGFI_VK._fields_ = [('offset', c_uint32),
119 ('cell_size', c_uint32),
120 ('name', c_char_p),
121 ('name_raw', POINTER(c_char)),
122 ('name_length', c_uint16),
123 ('hbin_off', c_uint32),
124 ('data_size', c_uint32),
125 ('data_off', c_uint32),
126 ('type', REGFI_DATA_TYPE),
127 ('magic', c_char * 2),
128 ('flags', c_uint16),
129 ('unknown1', c_uint16),
130 ('data_in_offset', c_bool),
131 ]
132
133
134REGFI_SK._fields_ = [('offset', c_uint32),
135 ('cell_size', c_uint32),
136 ('sec_desc', POINTER(WINSEC_DESC)),
137 ('hbin_off', c_uint32),
138 ('prev_sk_off', c_uint32),
139 ('next_sk_off', c_uint32),
140 ('ref_count', c_uint32),
141 ('desc_size', c_uint32),
142 ('unknown_tag', c_uint16),
143 ('magic', c_char * 2),
144 ]
145
146
147REGFI_NK._fields_ = [('offset', c_uint32),
148 ('cell_size', c_uint32),
149 ('values', POINTER(REGFI_VALUE_LIST)),
150 ('subkeys', POINTER(REGFI_SUBKEY_LIST)),
151 ('flags', c_uint16),
152 ('magic', c_char * 2),
153 ('mtime', REGFI_NTTIME),
154 ('name_length', c_uint16),
155 ('classname_length', c_uint16),
156 ('name', c_char_p),
157 ('name_raw', POINTER(c_char)),
158 ('parent_off', c_uint32),
159 ('classname_off', c_uint32),
160 ('max_bytes_subkeyname', c_uint32),
161 ('max_bytes_subkeyclassname', c_uint32),
162 ('max_bytes_valuename', c_uint32),
163 ('max_bytes_value', c_uint32),
164 ('unknown1', c_uint32),
165 ('unknown2', c_uint32),
166 ('unknown3', c_uint32),
167 ('unk_index', c_uint32),
168 ('num_subkeys', c_uint32),
169 ('subkeys_off', c_uint32),
170 ('num_values', c_uint32),
171 ('values_off', c_uint32),
172 ('sk_off', c_uint32),
173 ]
174
175
176REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32),
177 ('cell_size', c_uint32),
178 ('num_children', c_uint32),
179 ('num_keys', c_uint32),
180 ('elements', c_void_p),
181 ('magic', c_char * 2),
182 ('recursive_type', c_bool),
183 ]
184
185
186REGFI_VALUE_LIST._fields_ = [('offset', c_uint32),
187 ('cell_size', c_uint32),
188 ('num_values', c_uint32),
189 ('elements', c_void_p),
190 ]
191
192REGFI_CLASSNAME._fields_ = [('offset', c_uint32),
193 ('interpreted', c_char_p),
194 ('raw', POINTER(c_char)),
195 ('size', c_uint16),
196 ]
197
198
199class REGFI_DATA__interpreted(Union):
200 _fields_ = [('none',POINTER(c_char)),
201 ('string', c_char_p),
202 ('expand_string', c_char_p),
203 ('binary',POINTER(c_char)),
204 ('dword', c_uint32),
205 ('dword_be', c_uint32),
206 ('link', c_char_p),
207 ('multiple_string', POINTER(c_char_p)),
208 ('qword', c_uint64),
209 ('resource_list',POINTER(c_char)),
210 ('full_resource_descriptor',POINTER(c_char)),
211 ('resource_requirements_list',POINTER(c_char)),
212 ]
213REGFI_DATA._fields_ = [('offset', c_uint32),
214 ('type', REGFI_DATA_TYPE),
215 ('size', c_uint32),
216 ('raw', POINTER(c_char)),
217 ('interpreted_size', c_uint32),
218 ('interpreted', REGFI_DATA__interpreted),
219 ]
220
221
222REGFI_FILE._fields_ = [('magic', c_char * 4),
223 ('sequence1', c_uint32),
224 ('sequence2', c_uint32),
225 ('mtime', REGFI_NTTIME),
226 ('major_version', c_uint32),
227 ('minor_version', c_uint32),
228 ('type', c_uint32),
229 ('format', c_uint32),
230 ('root_cell', c_uint32),
231 ('last_block', c_uint32),
232 ('cluster', c_uint32),
233 ]
234
235
236REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type),
237 ('read', read_cb_type),
238 ('cur_off', c_uint64),
239 ('size', c_uint64),
240 ('state', c_void_p),
241 ]
242
243
244# Define function prototypes
245regfi.regfi_version.argtypes = []
246regfi.regfi_version.restype = c_char_p
247
248regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING]
249regfi.regfi_alloc.restype = POINTER(REGFI_FILE)
250
251regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING]
252regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE)
253
254regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)]
255regfi.regfi_free.restype = None
256
257regfi.regfi_log_get_str.argtypes = []
258regfi.regfi_log_get_str.restype = c_char_p
259
260regfi.regfi_log_set_mask.argtypes = [c_uint16]
261regfi.regfi_log_set_mask.restype = c_bool
262
263regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)]
264regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK)
265
266regfi.regfi_free_record.argtypes = [POINTER(REGFI_FILE), c_void_p]
267regfi.regfi_free_record.restype = None
268
269regfi.regfi_reference_record.argtypes = [POINTER(REGFI_FILE), c_void_p]
270regfi.regfi_reference_record.restype = c_void_p
271
272regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)]
273regfi.regfi_fetch_num_subkeys.restype = c_uint32
274
275regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)]
276regfi.regfi_fetch_num_values.restype = c_uint32
277
278regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
279regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME)
280
281regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
282regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK)
283
284regfi.regfi_next_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)]
285regfi.regfi_next_sk.restype = POINTER(REGFI_SK)
286
287regfi.regfi_prev_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_SK)]
288regfi.regfi_prev_sk.restype = POINTER(REGFI_SK)
289
290regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)]
291regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA)
292
293regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
294 c_char_p, POINTER(c_uint32)]
295regfi.regfi_find_subkey.restype = c_bool
296
297regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
298 c_char_p, POINTER(c_uint32)]
299regfi.regfi_find_value.restype = c_bool
300
301regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
302 c_uint32]
303regfi.regfi_get_subkey.restype = POINTER(REGFI_NK)
304
305regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
306 c_uint32]
307regfi.regfi_get_value.restype = POINTER(REGFI_VK)
308
309regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
310regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK)
311
312regfi.regfi_nt2unix_time.argtypes = [REGFI_NTTIME]
313regfi.regfi_nt2unix_time.restype = c_double
314
315regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE)]
316regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR)
317
318regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)]
319regfi.regfi_iterator_free.restype = None
320
321regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)]
322regfi.regfi_iterator_down.restype = c_bool
323
324regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)]
325regfi.regfi_iterator_up.restype = c_bool
326
327regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)]
328regfi.regfi_iterator_to_root.restype = c_bool
329
330regfi.regfi_iterator_descend.argtypes = [POINTER(REGFI_ITERATOR), POINTER(c_char_p)]
331regfi.regfi_iterator_descend.restype = c_bool
332
333regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)]
334regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK)
335
336regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
337regfi.regfi_iterator_first_subkey.restype = c_bool
338
339regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
340regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK)
341
342regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
343regfi.regfi_iterator_next_subkey.restype = c_bool
344
345regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p]
346regfi.regfi_iterator_find_subkey.restype = c_bool
347
348regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)]
349regfi.regfi_iterator_first_value.restype = c_bool
350
351regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)]
352regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK)
353
354regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)]
355regfi.regfi_iterator_next_value.restype = c_bool
356
357regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p]
358regfi.regfi_iterator_find_value.restype = c_bool
359
360regfi.regfi_iterator_ancestry.argtypes = [POINTER(REGFI_ITERATOR)]
361regfi.regfi_iterator_ancestry.restype = POINTER(POINTER(REGFI_NK))
362
363regfi.regfi_init.argtypes = []
364regfi.regfi_init.restype = None
365regfi.regfi_init()
Note: See TracBrowser for help on using the repository browser.