1 | #!/usr/bin/env python
|
---|
2 |
|
---|
3 | ## @package pyregfi.structures
|
---|
4 | # Low-level data structures and C API mappings.
|
---|
5 | #
|
---|
6 | # Most users need not venture here. For more information, see the source.
|
---|
7 |
|
---|
8 | import sys
|
---|
9 | import os
|
---|
10 | import traceback
|
---|
11 | import ctypes
|
---|
12 | import ctypes.util
|
---|
13 | from ctypes import *
|
---|
14 |
|
---|
15 | is_win32 = hasattr(ctypes, 'windll')
|
---|
16 |
|
---|
17 | # XXX: can we always be sure enums are this size?
|
---|
18 | REGFI_ENCODING = c_uint32
|
---|
19 | REGFI_ENCODING_UTF8 = REGFI_ENCODING(1)
|
---|
20 |
|
---|
21 | REGFI_DATA_TYPE = c_uint32
|
---|
22 |
|
---|
23 |
|
---|
24 | # Prototype everything first so we don't have to worry about reference order
|
---|
25 | class REGFI_NTTIME(Structure):
|
---|
26 | pass
|
---|
27 |
|
---|
28 | class REGFI_VK(Structure):
|
---|
29 | pass
|
---|
30 |
|
---|
31 | class REGFI_SK(Structure):
|
---|
32 | pass
|
---|
33 |
|
---|
34 | class REGFI_SUBKEY_LIST(Structure):
|
---|
35 | pass
|
---|
36 |
|
---|
37 | class REGFI_VALUE_LIST(Structure):
|
---|
38 | pass
|
---|
39 |
|
---|
40 | class REGFI_CLASSNAME(Structure):
|
---|
41 | pass
|
---|
42 |
|
---|
43 | class REGFI_DATA(Structure):
|
---|
44 | pass
|
---|
45 |
|
---|
46 | class REGFI_NK(Structure):
|
---|
47 | pass
|
---|
48 |
|
---|
49 | class REGFI_ITERATOR(Structure):
|
---|
50 | pass
|
---|
51 |
|
---|
52 | class REGFI_FILE(Structure):
|
---|
53 | pass
|
---|
54 |
|
---|
55 | class REGFI_RAW_FILE(Structure):
|
---|
56 | fh = None
|
---|
57 |
|
---|
58 | def cb_seek(self, raw_file, offset, whence):
|
---|
59 | try:
|
---|
60 | self.fh.seek(offset, whence)
|
---|
61 | except Exception:
|
---|
62 | traceback.print_exc()
|
---|
63 | set_errno(74) # os.EX_IOERR
|
---|
64 | return -1
|
---|
65 |
|
---|
66 | return self.fh.tell()
|
---|
67 |
|
---|
68 |
|
---|
69 | def cb_read(self, raw_file, buf, count):
|
---|
70 | try:
|
---|
71 | # XXX: anyway to do a readinto() here?
|
---|
72 | tmp = self.fh.read(count)
|
---|
73 | memmove(buf,tmp,len(tmp))
|
---|
74 |
|
---|
75 | except Exception:
|
---|
76 | traceback.print_exc()
|
---|
77 | set_errno(74) # os.EX_IOERR
|
---|
78 | return -1
|
---|
79 | return len(tmp)
|
---|
80 |
|
---|
81 |
|
---|
82 | # Load libregfi according to platform
|
---|
83 | regfi = None
|
---|
84 | if is_win32:
|
---|
85 | # XXX: Using C calling conventions on cross-compiled DLLs seems to work fine
|
---|
86 | # on Windows, but I'm not sure if stdcall symbols are supported
|
---|
87 | # correctly for native Windows binaries...
|
---|
88 | #regfi = ctypes.windll.libregfi
|
---|
89 | #CB_FACTORY = ctypes.WINFUNCTYPE
|
---|
90 | regfi = ctypes.CDLL('libregfi.dll', use_errno=True)
|
---|
91 | CB_FACTORY = ctypes.CFUNCTYPE
|
---|
92 | else:
|
---|
93 | regfi = ctypes.CDLL(ctypes.util.find_library('regfi'), use_errno=True)
|
---|
94 | CB_FACTORY = ctypes.CFUNCTYPE
|
---|
95 |
|
---|
96 | seek_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), c_uint64, c_int, use_errno=True)
|
---|
97 | read_cb_type = CB_FACTORY(c_int64, POINTER(REGFI_RAW_FILE), POINTER(c_char), c_size_t, use_errno=True)
|
---|
98 |
|
---|
99 |
|
---|
100 | REGFI_NTTIME._fields_ = [('low', c_uint32),
|
---|
101 | ('high', c_uint32)]
|
---|
102 |
|
---|
103 | REGFI_VK._fields_ = [('offset', c_uint32),
|
---|
104 | ('cell_size', c_uint32),
|
---|
105 | ('name', c_char_p),
|
---|
106 | ('name_raw', POINTER(c_char)),
|
---|
107 | ('name_length', c_uint16),
|
---|
108 | ('hbin_off', c_uint32),
|
---|
109 | ('data_size', c_uint32),
|
---|
110 | ('data_off', c_uint32),
|
---|
111 | ('type', REGFI_DATA_TYPE),
|
---|
112 | ('magic', c_char * 2),
|
---|
113 | ('flags', c_uint16),
|
---|
114 | ('unknown1', c_uint16),
|
---|
115 | ('data_in_offset', c_bool),
|
---|
116 | ]
|
---|
117 |
|
---|
118 |
|
---|
119 | REGFI_SK._fields_ = [('offset', c_uint32),
|
---|
120 | ('cell_size', c_uint32),
|
---|
121 | ('sec_desc', c_void_p), #XXX
|
---|
122 | ('hbin_off', c_uint32),
|
---|
123 | ('prev_sk_off', c_uint32),
|
---|
124 | ('next_sk_off', c_uint32),
|
---|
125 | ('ref_count', c_uint32),
|
---|
126 | ('desc_size', c_uint32),
|
---|
127 | ('unknown_tag', c_uint16),
|
---|
128 | ('magic', c_char * 2),
|
---|
129 | ]
|
---|
130 |
|
---|
131 |
|
---|
132 | REGFI_NK._fields_ = [('offset', c_uint32),
|
---|
133 | ('cell_size', c_uint32),
|
---|
134 | ('values', POINTER(REGFI_VALUE_LIST)),
|
---|
135 | ('subkeys', POINTER(REGFI_SUBKEY_LIST)),
|
---|
136 | ('flags', c_uint16),
|
---|
137 | ('magic', c_char * 2),
|
---|
138 | ('mtime', REGFI_NTTIME),
|
---|
139 | ('name_length', c_uint16),
|
---|
140 | ('classname_length', c_uint16),
|
---|
141 | ('name', c_char_p),
|
---|
142 | ('name_raw', POINTER(c_char)),
|
---|
143 | ('parent_off', c_uint32),
|
---|
144 | ('classname_off', c_uint32),
|
---|
145 | ('max_bytes_subkeyname', c_uint32),
|
---|
146 | ('max_bytes_subkeyclassname', c_uint32),
|
---|
147 | ('max_bytes_valuename', c_uint32),
|
---|
148 | ('max_bytes_value', c_uint32),
|
---|
149 | ('unknown1', c_uint32),
|
---|
150 | ('unknown2', c_uint32),
|
---|
151 | ('unknown3', c_uint32),
|
---|
152 | ('unk_index', c_uint32),
|
---|
153 | ('num_subkeys', c_uint32),
|
---|
154 | ('subkeys_off', c_uint32),
|
---|
155 | ('num_values', c_uint32),
|
---|
156 | ('values_off', c_uint32),
|
---|
157 | ('sk_off', c_uint32),
|
---|
158 | ]
|
---|
159 |
|
---|
160 |
|
---|
161 | REGFI_SUBKEY_LIST._fields_ = [('offset', c_uint32),
|
---|
162 | ('cell_size', c_uint32),
|
---|
163 | ('num_children', c_uint32),
|
---|
164 | ('num_keys', c_uint32),
|
---|
165 | ('elements', c_void_p),
|
---|
166 | ('magic', c_char * 2),
|
---|
167 | ('recursive_type', c_bool),
|
---|
168 | ]
|
---|
169 |
|
---|
170 |
|
---|
171 | REGFI_VALUE_LIST._fields_ = [('offset', c_uint32),
|
---|
172 | ('cell_size', c_uint32),
|
---|
173 | ('num_values', c_uint32),
|
---|
174 | ('elements', c_void_p),
|
---|
175 | ]
|
---|
176 |
|
---|
177 | REGFI_CLASSNAME._fields_ = [('offset', c_uint32),
|
---|
178 | ('interpreted', c_char_p),
|
---|
179 | ('raw', POINTER(c_char)),
|
---|
180 | ('size', c_uint16),
|
---|
181 | ]
|
---|
182 |
|
---|
183 |
|
---|
184 | class REGFI_DATA__interpreted(Union):
|
---|
185 | _fields_ = [('none',POINTER(c_char)),
|
---|
186 | ('string', c_char_p),
|
---|
187 | ('expand_string', c_char_p),
|
---|
188 | ('binary',POINTER(c_char)),
|
---|
189 | ('dword', c_uint32),
|
---|
190 | ('dword_be', c_uint32),
|
---|
191 | ('link', c_char_p),
|
---|
192 | ('multiple_string', POINTER(c_char_p)),
|
---|
193 | ('qword', c_uint64),
|
---|
194 | ('resource_list',POINTER(c_char)),
|
---|
195 | ('full_resource_descriptor',POINTER(c_char)),
|
---|
196 | ('resource_requirements_list',POINTER(c_char)),
|
---|
197 | ]
|
---|
198 | REGFI_DATA._fields_ = [('offset', c_uint32),
|
---|
199 | ('type', REGFI_DATA_TYPE),
|
---|
200 | ('size', c_uint32),
|
---|
201 | ('raw', POINTER(c_char)),
|
---|
202 | ('interpreted_size', c_uint32),
|
---|
203 | ('interpreted', REGFI_DATA__interpreted),
|
---|
204 | ]
|
---|
205 |
|
---|
206 |
|
---|
207 | REGFI_FILE._fields_ = [('magic', c_char * 4),
|
---|
208 | ('sequence1', c_uint32),
|
---|
209 | ('sequence2', c_uint32),
|
---|
210 | ('mtime', REGFI_NTTIME),
|
---|
211 | ('major_version', c_uint32),
|
---|
212 | ('minor_version', c_uint32),
|
---|
213 | ('type', c_uint32),
|
---|
214 | ('format', c_uint32),
|
---|
215 | ('root_cell', c_uint32),
|
---|
216 | ('last_block', c_uint32),
|
---|
217 | ('cluster', c_uint32),
|
---|
218 | ]
|
---|
219 |
|
---|
220 |
|
---|
221 | REGFI_RAW_FILE._fields_ = [('seek', seek_cb_type),
|
---|
222 | ('read', read_cb_type),
|
---|
223 | ('cur_off', c_uint64),
|
---|
224 | ('size', c_uint64),
|
---|
225 | ('state', c_void_p),
|
---|
226 | ]
|
---|
227 |
|
---|
228 |
|
---|
229 | # Define function prototypes
|
---|
230 | regfi.regfi_version.argtypes = []
|
---|
231 | regfi.regfi_version.restype = c_char_p
|
---|
232 |
|
---|
233 | regfi.regfi_alloc.argtypes = [c_int, REGFI_ENCODING]
|
---|
234 | regfi.regfi_alloc.restype = POINTER(REGFI_FILE)
|
---|
235 |
|
---|
236 | regfi.regfi_alloc_cb.argtypes = [POINTER(REGFI_RAW_FILE), REGFI_ENCODING]
|
---|
237 | regfi.regfi_alloc_cb.restype = POINTER(REGFI_FILE)
|
---|
238 |
|
---|
239 | regfi.regfi_free.argtypes = [POINTER(REGFI_FILE)]
|
---|
240 | regfi.regfi_free.restype = None
|
---|
241 |
|
---|
242 | regfi.regfi_log_get_str.argtypes = []
|
---|
243 | regfi.regfi_log_get_str.restype = c_char_p
|
---|
244 |
|
---|
245 | regfi.regfi_log_set_mask.argtypes = [c_uint16]
|
---|
246 | regfi.regfi_log_set_mask.restype = c_bool
|
---|
247 |
|
---|
248 | regfi.regfi_get_rootkey.argtypes = [POINTER(REGFI_FILE)]
|
---|
249 | regfi.regfi_get_rootkey.restype = POINTER(REGFI_NK)
|
---|
250 |
|
---|
251 | regfi.regfi_free_record.argtypes = [POINTER(REGFI_FILE), c_void_p]
|
---|
252 | regfi.regfi_free_record.restype = None
|
---|
253 |
|
---|
254 | regfi.regfi_reference_record.argtypes = [POINTER(REGFI_FILE), c_void_p]
|
---|
255 | regfi.regfi_reference_record.restype = c_bool
|
---|
256 |
|
---|
257 | regfi.regfi_fetch_num_subkeys.argtypes = [POINTER(REGFI_NK)]
|
---|
258 | regfi.regfi_fetch_num_subkeys.restype = c_uint32
|
---|
259 |
|
---|
260 | regfi.regfi_fetch_num_values.argtypes = [POINTER(REGFI_NK)]
|
---|
261 | regfi.regfi_fetch_num_values.restype = c_uint32
|
---|
262 |
|
---|
263 | regfi.regfi_fetch_classname.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
|
---|
264 | regfi.regfi_fetch_classname.restype = POINTER(REGFI_CLASSNAME)
|
---|
265 |
|
---|
266 | regfi.regfi_fetch_sk.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
|
---|
267 | regfi.regfi_fetch_sk.restype = POINTER(REGFI_SK)
|
---|
268 |
|
---|
269 | regfi.regfi_fetch_data.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_VK)]
|
---|
270 | regfi.regfi_fetch_data.restype = POINTER(REGFI_DATA)
|
---|
271 |
|
---|
272 | regfi.regfi_find_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
|
---|
273 | c_char_p, POINTER(c_uint32)]
|
---|
274 | regfi.regfi_find_subkey.restype = c_bool
|
---|
275 |
|
---|
276 | regfi.regfi_find_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
|
---|
277 | c_char_p, POINTER(c_uint32)]
|
---|
278 | regfi.regfi_find_value.restype = c_bool
|
---|
279 |
|
---|
280 | regfi.regfi_get_subkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
|
---|
281 | c_uint32]
|
---|
282 | regfi.regfi_get_subkey.restype = POINTER(REGFI_NK)
|
---|
283 |
|
---|
284 | regfi.regfi_get_value.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK),
|
---|
285 | c_uint32]
|
---|
286 | regfi.regfi_get_value.restype = POINTER(REGFI_VK)
|
---|
287 |
|
---|
288 | regfi.regfi_get_parentkey.argtypes = [POINTER(REGFI_FILE), POINTER(REGFI_NK)]
|
---|
289 | regfi.regfi_get_parentkey.restype = POINTER(REGFI_NK)
|
---|
290 |
|
---|
291 | regfi.regfi_nt2unix_time.argtypes = [POINTER(REGFI_NTTIME)]
|
---|
292 | regfi.regfi_nt2unix_time.restype = c_double
|
---|
293 |
|
---|
294 | regfi.regfi_iterator_new.argtypes = [POINTER(REGFI_FILE)]
|
---|
295 | regfi.regfi_iterator_new.restype = POINTER(REGFI_ITERATOR)
|
---|
296 |
|
---|
297 | regfi.regfi_iterator_free.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
298 | regfi.regfi_iterator_free.restype = None
|
---|
299 |
|
---|
300 | regfi.regfi_iterator_down.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
301 | regfi.regfi_iterator_down.restype = c_bool
|
---|
302 |
|
---|
303 | regfi.regfi_iterator_up.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
304 | regfi.regfi_iterator_up.restype = c_bool
|
---|
305 |
|
---|
306 | regfi.regfi_iterator_to_root.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
307 | regfi.regfi_iterator_to_root.restype = c_bool
|
---|
308 |
|
---|
309 | regfi.regfi_iterator_walk_path.argtypes = [POINTER(REGFI_ITERATOR), POINTER(c_char_p)]
|
---|
310 | regfi.regfi_iterator_walk_path.restype = c_bool
|
---|
311 |
|
---|
312 | regfi.regfi_iterator_cur_key.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
313 | regfi.regfi_iterator_cur_key.restype = POINTER(REGFI_NK)
|
---|
314 |
|
---|
315 | regfi.regfi_iterator_first_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
316 | regfi.regfi_iterator_first_subkey.restype = c_bool
|
---|
317 |
|
---|
318 | regfi.regfi_iterator_cur_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
319 | regfi.regfi_iterator_cur_subkey.restype = POINTER(REGFI_NK)
|
---|
320 |
|
---|
321 | regfi.regfi_iterator_next_subkey.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
322 | regfi.regfi_iterator_next_subkey.restype = c_bool
|
---|
323 |
|
---|
324 | regfi.regfi_iterator_find_subkey.argtypes = [POINTER(REGFI_ITERATOR), c_char_p]
|
---|
325 | regfi.regfi_iterator_find_subkey.restype = c_bool
|
---|
326 |
|
---|
327 | regfi.regfi_iterator_first_value.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
328 | regfi.regfi_iterator_first_value.restype = c_bool
|
---|
329 |
|
---|
330 | regfi.regfi_iterator_cur_value.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
331 | regfi.regfi_iterator_cur_value.restype = POINTER(REGFI_VK)
|
---|
332 |
|
---|
333 | regfi.regfi_iterator_next_value.argtypes = [POINTER(REGFI_ITERATOR)]
|
---|
334 | regfi.regfi_iterator_next_value.restype = c_bool
|
---|
335 |
|
---|
336 | regfi.regfi_iterator_find_value.argtypes = [POINTER(REGFI_ITERATOR), c_char_p]
|
---|
337 | regfi.regfi_iterator_find_value.restype = c_bool
|
---|
338 |
|
---|
339 |
|
---|
340 | regfi.regfi_init.argtypes = []
|
---|
341 | regfi.regfi_init.restype = None
|
---|
342 | regfi.regfi_init()
|
---|