1 | #!/usr/bin/env python |
---|
2 | |
---|
3 | ## @package pyregfi.structures |
---|
4 | # Low-level data structures and C API mappings. |
---|
5 | # |
---|
6 | # Most users need not venture here. For more information, see the source. |
---|
7 | |
---|
8 | import sys |
---|
9 | import os |
---|
10 | import traceback |
---|
11 | import ctypes |
---|
12 | import ctypes.util |
---|
13 | from ctypes import * |
---|
14 | |
---|
15 | |
---|
16 | # XXX: can we always be sure enums are this size? |
---|
17 | REGFI_ENCODING = c_uint32 |
---|
18 | REGFI_ENCODING_UTF8 = 1 |
---|
19 | |
---|
20 | REGFI_DATA_TYPE = c_uint32 |
---|
21 | REGFI_REGF_SIZE = 0x1000 |
---|
22 | |
---|
23 | |
---|
24 | # Prototype everything first so we don't have to worry about reference order |
---|
25 | class REGFI_NTTIME(Structure): |
---|
26 | pass |
---|
27 | |
---|
28 | class REGFI_VK(Structure): |
---|
29 | pass |
---|
30 | |
---|
31 | class REGFI_SK(Structure): |
---|
32 | pass |
---|
33 | |
---|
34 | class REGFI_SUBKEY_LIST(Structure): |
---|
35 | pass |
---|
36 | |
---|
37 | class REGFI_VALUE_LIST(Structure): |
---|
38 | pass |
---|
39 | |
---|
40 | class REGFI_CLASSNAME(Structure): |
---|
41 | pass |
---|
42 | |
---|
43 | class REGFI_DATA(Structure): |
---|
44 | pass |
---|
45 | |
---|
46 | class REGFI_NK(Structure): |
---|
47 | pass |
---|
48 | |
---|
49 | class REGFI_ITERATOR(Structure): |
---|
50 | pass |
---|
51 | |
---|
52 | class REGFI_FILE(Structure): |
---|
53 | pass |
---|
54 | |
---|
55 | class REGFI_RAW_FILE(Structure): |
---|
56 | fh = None |
---|
57 | |
---|
58 | def cb_seek(self, raw_file, offset, whence): |
---|
59 | try: |
---|
60 | self.fh.seek(offset, whence) |
---|
61 | except Exception: |
---|
62 | traceback.print_exc() |
---|
63 | # XXX: os.EX_IOERR may not be available on Windoze |
---|
64 | set_errno(os.EX_IOERR) |
---|
65 | return -1 |
---|
66 | |
---|
67 | return self.fh.tell() |
---|
68 | |
---|
69 | |
---|
70 | def cb_read(self, raw_file, buf, count): |
---|
71 | try: |
---|
72 | # XXX: anyway to do a readinto() here? |
---|
73 | tmp = self.fh.read(count) |
---|
74 | memmove(buf,tmp,len(tmp)) |
---|
75 | |
---|
76 | except Exception: |
---|
77 | traceback.print_exc() |
---|
78 | # XXX: os.EX_IOERR may not be available on Windoze |
---|
79 | set_errno(os.EX_IOERR) |
---|
80 | return -1 |
---|
81 | return len(tmp) |
---|
82 | |
---|
83 | |
---|
84 | # Load libregfi according to platform |
---|
85 | regfi = None |
---|
86 | if hasattr(ctypes, 'windll'): |
---|
87 | #regfi = ctypes.windll.libregfi |
---|
88 | regfi = ctypes.WinDLL('libregfi.dll', use_errno=True) |
---|
89 | CB_FACTORY = ctypes.WINFUNCTYPE |
---|
90 | else: |
---|
91 | regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True) |
---|
92 | CB_FACTORY = ctypes.CFUNCTYPE |
---|
93 | |
---|
94 | # XXX: how can we know for sure the size of off_t? |
---|
95 | # -D_FILE_OFFSET_BITS=64 might help, need to research this |
---|
96 | # Also, may need to use something like ctypes_configure |
---|
97 | #seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True) |
---|
98 | seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int) |
---|
99 | #read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t, use_errno=True) |
---|
100 | read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t) |
---|
101 | |
---|
102 | |
---|
103 | REGFI_NTTIME._fields_ = [('low', c_uint32), |
---|
104 | ('high', c_uint32)] |
---|
105 | |
---|
106 | REGFI_VK._fields_ = [('offset', c_uint32), |
---|
107 | ('cell_size', c_uint32), |
---|
108 | ('name', c_char_p), |
---|
109 | ('name_raw', POINTER(c_char)), |
---|
110 | ('name_length', c_uint16), |
---|
111 | ('hbin_off', c_uint32), |
---|
112 | ('data_size', c_uint32), |
---|
113 | ('data_off', c_uint32), |
---|
114 | ('type', REGFI_DATA_TYPE), |
---|
115 | ('magic', c_char * 2), |
---|
116 | ('flags', c_uint16), |
---|
117 | ('unknown1', c_uint16), |
---|
118 | ('data_in_offset', c_bool), |
---|
119 | ] |
---|
120 | |
---|
121 | |
---|
122 | REGFI_SK._fields_ = [('offset', c_uint32), |
---|
123 | ('cell_size', c_uint32), |
---|
124 | ('sec_desc', c_void_p), #XXX |
---|
125 | ('hbin_off', c_uint32), |
---|
126 | ('prev_sk_off', c_uint32), |
---|
127 | ('next_sk_off', c_uint32), |
---|
128 | ('ref_count', c_uint32), |
---|
129 | ('desc_size', c_uint32), |
---|
130 | ('unknown_tag', c_uint16), |
---|
131 | ('magic', c_char * 2), |
---|
132 | ] |
---|
133 | |
---|
134 | |
---|
135 | REGFI_NK._fields_ = [('offset', c_uint32), |
---|
136 | ('cell_size', c_uint32), |
---|
137 | ('values', POINTER(REGFI_VALUE_LIST)), |
---|
138 | ('subkeys', POINTER(REGFI_SUBKEY_LIST)), |
---|
139 | ('flags', c_uint16), |
---|
140 | ('magic', c_char * 2), |
---|
141 | ('mtime', REGFI_NTTIME), |
---|
142 | ('name_length', c_uint16), |
---|
143 | ('classname_length', c_uint16), |
---|
144 | ('name', c_char_p), |
---|
145 | ('name_raw', POINTER(c_char)), |
---|
146 | ('parent_off', c_uint32), |
---|
147 | ('classname_off', c_uint32), |
---|
148 | ('max_bytes_subkeyname', c_uint32), |
---|
149 | ('max_bytes_subkeyclassname', c_uint32), |
---|
150 | ('max_bytes_valuename', c_uint32), |
---|
151 | ('max_bytes_value', c_uint32), |
---|
152 | ('unknown1', c_uint32), |
---|
153 | ('unknown2', c_uint32), |
---|
154 | ('unknown3', c_uint32), |
---|
155 | ('unk_index', c_uint32), |
---|
156 | ('num_subkeys', c_uint32), |
---|
157 | ('subkeys_off', c_uint32), |
---|
158 | ('num_values', c_uint32), |
---|
159 | ('values_off', c_uint32), |
---|
160 | ('sk_off', c_uint32), |
---|
161 | ] |
---|
162 | |
---|
163 | |
---|
164 | REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32), |
---|
165 | ('cell_size', c_uint32), |
---|
166 | ('num_children', c_uint32), |
---|
167 | ('num_keys', c_uint32), |
---|
168 | ('elements', c_void_p), |
---|
169 | ('magic', c_char * 2), |
---|
170 | ('recursive_type', c_bool), |
---|
171 | ] |
---|
172 | |
---|
173 | |
---|
174 | REGFI_VALUE_LIST._fields_ = [('offset', c_uint32), |
---|
175 | ('cell_size', c_uint32), |
---|
176 | ('num_children', c_uint32), |
---|
177 | ('num_values', c_uint32), |
---|
178 | ('elements', c_void_p), |
---|
179 | ] |
---|
180 | |
---|
181 | REGFI_CLASSNAME._fields_ = [('offset', c_uint32), |
---|
182 | ('interpreted', c_char_p), |
---|
183 | ('raw', POINTER(c_char)), |
---|
184 | ('size', c_uint16), |
---|
185 | ] |
---|
186 | |
---|
187 | |
---|
188 | class REGFI_DATA__interpreted(Union): |
---|
189 | _fields_ = [('none',POINTER(c_char)), |
---|
190 | ('string', c_char_p), |
---|
191 | ('expand_string', c_char_p), |
---|
192 | ('binary',POINTER(c_char)), |
---|
193 | ('dword', c_uint32), |
---|
194 | ('dword_be', c_uint32), |
---|
195 | ('link', c_char_p), |
---|
196 | ('multiple_string', POINTER(c_char_p)), |
---|
197 | ('qword', c_uint64), |
---|
198 | ('resource_list',POINTER(c_char)), |
---|
199 | ('full_resource_descriptor',POINTER(c_char)), |
---|
200 | ('resource_requirements_list',POINTER(c_char)), |
---|
201 | ] |
---|
202 | REGFI_DATA._fields_ = [('offset', c_uint32), |
---|
203 | ('type', REGFI_DATA_TYPE), |
---|
204 | ('size', c_uint32), |
---|
205 | ('raw', POINTER(c_char)), |
---|
206 | ('interpreted_size', c_uint32), |
---|
207 | ('interpreted', REGFI_DATA__interpreted), |
---|
208 | ] |
---|
209 | |
---|
210 | |
---|
211 | REGFI_FILE._fields_ = [('magic', c_char * 4), |
---|
212 | ('sequence1', c_uint32), |
---|
213 | ('sequence2', c_uint32), |
---|
214 | ('mtime', REGFI_NTTIME), |
---|
215 | ('major_version', c_uint32), |
---|
216 | ('minor_version', c_uint32), |
---|
217 | ('type', c_uint32), |
---|
218 | ('format', c_uint32), |
---|
219 | ('root_cell', c_uint32), |
---|
220 | ('last_block', c_uint32), |
---|
221 | ('cluster', c_uint32), |
---|
222 | ] |
---|
223 | |
---|
224 | |
---|
225 | REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type), |
---|
226 | ('read', read_cb_type), |
---|
227 | ('cur_off', c_uint64), |
---|
228 | ('size', c_uint64), |
---|
229 | ('state', c_void_p), |
---|
230 | ] |
---|
231 | |
---|
232 | |
---|
233 | # Define function prototypes |
---|
234 | regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING] |
---|
235 | regfi.regfi_alloc.restype = POINTER(REGFI_FILE) |
---|
236 | |
---|
237 | regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING] |
---|
238 | regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE) |
---|
239 | |
---|
240 | regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)] |
---|
241 | regfi.regfi_free.restype = None |
---|
242 | |
---|
243 | regfi.regfi_log_get_str.argtypes = [] |
---|
244 | regfi.regfi_log_get_str.restype = c_char_p |
---|
245 | |
---|
246 | regfi.regfi_log_set_mask.argtypes = [c_uint16] |
---|
247 | regfi.regfi_log_set_mask.restype = c_bool |
---|
248 | |
---|
249 | regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)] |
---|
250 | regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK) |
---|
251 | |
---|
252 | regfi.regfi_free_record.argtypes = [c_void_p] |
---|
253 | regfi.regfi_free_record.restype = None |
---|
254 | |
---|
255 | regfi.regfi_reference_record.argtypes = [c_void_p] |
---|
256 | regfi.regfi_reference_record.restype = c_bool |
---|
257 | |
---|
258 | regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)] |
---|
259 | regfi.regfi_fetch_num_subkeys.restype = c_uint32 |
---|
260 | |
---|
261 | regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)] |
---|
262 | regfi.regfi_fetch_num_values.restype = c_uint32 |
---|
263 | |
---|
264 | regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
265 | regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME) |
---|
266 | |
---|
267 | regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
268 | regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK) |
---|
269 | |
---|
270 | regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)] |
---|
271 | regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA) |
---|
272 | |
---|
273 | regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
274 | c_char_p, POINTER(c_uint32)] |
---|
275 | regfi.regfi_find_subkey.restype = c_bool |
---|
276 | |
---|
277 | regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
278 | c_char_p, POINTER(c_uint32)] |
---|
279 | regfi.regfi_find_value.restype = c_bool |
---|
280 | |
---|
281 | regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
282 | c_uint32] |
---|
283 | regfi.regfi_get_subkey.restype = POINTER(REGFI_NK) |
---|
284 | |
---|
285 | regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK), |
---|
286 | c_uint32] |
---|
287 | regfi.regfi_get_value.restype = POINTER(REGFI_VK) |
---|
288 | |
---|
289 | regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)] |
---|
290 | regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK) |
---|
291 | |
---|
292 | regfi.regfi_nt2unix_time.argtypes = [POINTER(REGFI_NTTIME)] |
---|
293 | regfi.regfi_nt2unix_time.restype = c_double |
---|
294 | |
---|
295 | regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE), REGFI_ENCODING] |
---|
296 | regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR) |
---|
297 | |
---|
298 | regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
299 | regfi.regfi_iterator_free.restype = None |
---|
300 | |
---|
301 | regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
302 | regfi.regfi_iterator_down.restype = c_bool |
---|
303 | |
---|
304 | regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
305 | regfi.regfi_iterator_up.restype = c_bool |
---|
306 | |
---|
307 | regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
308 | regfi.regfi_iterator_to_root.restype = c_bool |
---|
309 | |
---|
310 | regfi.regfi_iterator_walk_path.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
311 | regfi.regfi_iterator_walk_path.restype = c_bool |
---|
312 | |
---|
313 | regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
314 | regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK) |
---|
315 | |
---|
316 | regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
317 | regfi.regfi_iterator_first_subkey.restype = c_bool |
---|
318 | |
---|
319 | regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
320 | regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK) |
---|
321 | |
---|
322 | regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
323 | regfi.regfi_iterator_next_subkey.restype = c_bool |
---|
324 | |
---|
325 | regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
326 | regfi.regfi_iterator_find_subkey.restype = c_bool |
---|
327 | |
---|
328 | regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
329 | regfi.regfi_iterator_first_value.restype = c_bool |
---|
330 | |
---|
331 | regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
332 | regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK) |
---|
333 | |
---|
334 | regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)] |
---|
335 | regfi.regfi_iterator_next_value.restype = c_bool |
---|
336 | |
---|
337 | regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p] |
---|
338 | regfi.regfi_iterator_find_value.restype = c_bool |
---|
339 | |
---|
340 | |
---|
341 | regfi.regfi_init.argtypes = [] |
---|
342 | regfi.regfi_init.restype = None |
---|
343 | regfi.regfi_init() |
---|