[111] | 1 | /* |
---|
[121] | 2 | * This file stores code common to the command line tools. |
---|
| 3 | * XXX: This should be converted to a proper library. |
---|
[111] | 4 | * |
---|
| 5 | * Copyright (C) 2005-2008 Timothy D. Morgan |
---|
| 6 | * Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com |
---|
| 7 | * |
---|
| 8 | * This program is free software; you can redistribute it and/or modify |
---|
| 9 | * it under the terms of the GNU General Public License as published by |
---|
| 10 | * the Free Software Foundation; version 3 of the License. |
---|
| 11 | * |
---|
| 12 | * This program is distributed in the hope that it will be useful, |
---|
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 15 | * GNU General Public License for more details. |
---|
| 16 | * |
---|
| 17 | * You should have received a copy of the GNU General Public License |
---|
| 18 | * along with this program; if not, write to the Free Software |
---|
| 19 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
---|
| 20 | * |
---|
[121] | 21 | * $Id: common.c 182 2010-03-17 06:41:17Z tim $ |
---|
[111] | 22 | */ |
---|
| 23 | |
---|
| 24 | #include <iconv.h> |
---|
| 25 | iconv_t conv_desc; |
---|
| 26 | |
---|
| 27 | const char* key_special_chars = ",\"\\/"; |
---|
| 28 | const char* subfield_special_chars = ",\"\\|"; |
---|
| 29 | const char* common_special_chars = ",\"\\"; |
---|
| 30 | |
---|
[182] | 31 | #define REGLOOKUP_VERSION "0.1?.0" |
---|
[111] | 32 | |
---|
[143] | 33 | #define REGLOOKUP_EXIT_OK 0 |
---|
| 34 | #define REGLOOKUP_EXIT_OSERR 71 |
---|
| 35 | #define REGLOOKUP_EXIT_USAGE 64 |
---|
| 36 | #define REGLOOKUP_EXIT_DATAERR 65 |
---|
| 37 | #define REGLOOKUP_EXIT_NOINPUT 66 |
---|
[111] | 38 | |
---|
[143] | 39 | |
---|
[178] | 40 | /* Windows is lame */ |
---|
| 41 | #ifdef O_BINARY |
---|
| 42 | #define REGLOOKUP_OPEN_FLAGS O_RDONLY|O_BINARY |
---|
| 43 | #else |
---|
| 44 | #define REGLOOKUP_OPEN_FLAGS O_RDONLY |
---|
| 45 | #endif |
---|
| 46 | |
---|
| 47 | |
---|
[111] | 48 | void bailOut(int code, char* message) |
---|
| 49 | { |
---|
| 50 | fprintf(stderr, message); |
---|
[182] | 51 | regfi_log_stop(); |
---|
[111] | 52 | exit(code); |
---|
| 53 | } |
---|
| 54 | |
---|
[182] | 55 | void printMsgs() |
---|
[137] | 56 | { |
---|
[182] | 57 | char* msgs = regfi_log_get_str(); |
---|
[137] | 58 | if(msgs != NULL) |
---|
| 59 | { |
---|
| 60 | fprintf(stderr, "%s", msgs); |
---|
| 61 | free(msgs); |
---|
| 62 | } |
---|
| 63 | } |
---|
[111] | 64 | |
---|
[182] | 65 | void clearMsgs() |
---|
[138] | 66 | { |
---|
[182] | 67 | char* msgs = regfi_log_get_str(); |
---|
[138] | 68 | if(msgs != NULL) |
---|
| 69 | free(msgs); |
---|
| 70 | } |
---|
[137] | 71 | |
---|
[138] | 72 | |
---|
[111] | 73 | /* Returns a newly malloc()ed string which contains original buffer, |
---|
| 74 | * except for non-printable or special characters are quoted in hex |
---|
| 75 | * with the syntax '\xQQ' where QQ is the hex ascii value of the quoted |
---|
| 76 | * character. A null terminator is added, since only ascii, not binary, |
---|
| 77 | * is returned. |
---|
| 78 | */ |
---|
| 79 | static char* quote_buffer(const unsigned char* str, |
---|
| 80 | unsigned int len, const char* special) |
---|
| 81 | { |
---|
| 82 | unsigned int i, added_len; |
---|
| 83 | unsigned int num_written = 0; |
---|
| 84 | |
---|
| 85 | unsigned int buf_len = sizeof(char)*(len+1); |
---|
[136] | 86 | char* ret_val = NULL; |
---|
[111] | 87 | char* tmp_buf; |
---|
| 88 | |
---|
[136] | 89 | if(buf_len > 0) |
---|
| 90 | ret_val = malloc(buf_len); |
---|
[111] | 91 | if(ret_val == NULL) |
---|
| 92 | return NULL; |
---|
| 93 | |
---|
| 94 | for(i=0; i<len; i++) |
---|
| 95 | { |
---|
| 96 | if(buf_len <= (num_written+5)) |
---|
| 97 | { |
---|
| 98 | /* Expand the buffer by the memory consumption rate seen so far |
---|
| 99 | * times the amount of input left to process. The expansion is bounded |
---|
| 100 | * below by a minimum safety increase, and above by the maximum possible |
---|
| 101 | * output string length. This should minimize both the number of |
---|
| 102 | * reallocs() and the amount of wasted memory. |
---|
| 103 | */ |
---|
| 104 | added_len = (len-i)*num_written/(i+1); |
---|
| 105 | if((buf_len+added_len) > (len*4+1)) |
---|
| 106 | buf_len = len*4+1; |
---|
| 107 | else |
---|
| 108 | { |
---|
| 109 | if (added_len < 5) |
---|
| 110 | buf_len += 5; |
---|
| 111 | else |
---|
| 112 | buf_len += added_len; |
---|
| 113 | } |
---|
| 114 | |
---|
| 115 | tmp_buf = realloc(ret_val, buf_len); |
---|
| 116 | if(tmp_buf == NULL) |
---|
| 117 | { |
---|
| 118 | free(ret_val); |
---|
| 119 | return NULL; |
---|
| 120 | } |
---|
| 121 | ret_val = tmp_buf; |
---|
| 122 | } |
---|
| 123 | |
---|
| 124 | if(str[i] < 32 || str[i] > 126 || strchr(special, str[i]) != NULL) |
---|
| 125 | { |
---|
| 126 | num_written += snprintf(ret_val + num_written, buf_len - num_written, |
---|
| 127 | "\\x%.2X", str[i]); |
---|
| 128 | } |
---|
| 129 | else |
---|
| 130 | ret_val[num_written++] = str[i]; |
---|
| 131 | } |
---|
| 132 | ret_val[num_written] = '\0'; |
---|
| 133 | |
---|
| 134 | return ret_val; |
---|
| 135 | } |
---|
| 136 | |
---|
| 137 | |
---|
| 138 | /* Returns a newly malloc()ed string which contains original string, |
---|
| 139 | * except for non-printable or special characters are quoted in hex |
---|
| 140 | * with the syntax '\xQQ' where QQ is the hex ascii value of the quoted |
---|
| 141 | * character. |
---|
| 142 | */ |
---|
| 143 | static char* quote_string(const char* str, const char* special) |
---|
| 144 | { |
---|
| 145 | unsigned int len; |
---|
| 146 | |
---|
| 147 | if(str == NULL) |
---|
| 148 | return NULL; |
---|
| 149 | |
---|
| 150 | len = strlen(str); |
---|
| 151 | return quote_buffer((const unsigned char*)str, len, special); |
---|
| 152 | } |
---|
| 153 | |
---|
| 154 | |
---|
| 155 | /* |
---|
| 156 | * Convert a data value to a string for display. Returns NULL on error, |
---|
| 157 | * and the string to display if there is no error, or a non-fatal |
---|
| 158 | * error. On any error (fatal or non-fatal) occurs, (*error_msg) will |
---|
| 159 | * be set to a newly allocated string, containing an error message. If |
---|
| 160 | * a memory allocation failure occurs while generating the error |
---|
| 161 | * message, both the return value and (*error_msg) will be NULL. It |
---|
| 162 | * is the responsibility of the caller to free both a non-NULL return |
---|
| 163 | * value, and a non-NULL (*error_msg). |
---|
| 164 | */ |
---|
[159] | 165 | static char* data_to_ascii(REGFI_DATA* data, char** error_msg) |
---|
[111] | 166 | { |
---|
[159] | 167 | char* ret_val; |
---|
[111] | 168 | char* cur_quoted; |
---|
[159] | 169 | char* tmp_ptr; |
---|
| 170 | char* delim; |
---|
[168] | 171 | uint32_t ret_val_left, i, tmp_len; |
---|
[111] | 172 | |
---|
[159] | 173 | if(data == NULL || data->size == 0) |
---|
[111] | 174 | { |
---|
[159] | 175 | *error_msg = (char*)malloc(37); |
---|
[111] | 176 | if(*error_msg == NULL) |
---|
| 177 | return NULL; |
---|
[159] | 178 | strcpy(*error_msg, "Data pointer was NULL or size was 0."); |
---|
[111] | 179 | return NULL; |
---|
| 180 | } |
---|
| 181 | *error_msg = NULL; |
---|
| 182 | |
---|
[159] | 183 | |
---|
| 184 | if(data->interpreted_size == 0) |
---|
[111] | 185 | { |
---|
[159] | 186 | *error_msg = (char*)malloc(51); |
---|
| 187 | if(*error_msg == NULL) |
---|
| 188 | return NULL; |
---|
| 189 | strcpy(*error_msg, "Data could not be interpreted, quoting raw buffer."); |
---|
[171] | 190 | return quote_buffer(data->raw, data->size, subfield_special_chars); |
---|
[159] | 191 | } |
---|
| 192 | |
---|
| 193 | switch (data->type) |
---|
| 194 | { |
---|
[111] | 195 | case REG_SZ: |
---|
[159] | 196 | ret_val = quote_string((char*)data->interpreted.string, common_special_chars); |
---|
| 197 | if(ret_val == NULL && (*error_msg = (char*)malloc(49)) != NULL) |
---|
| 198 | strcpy(*error_msg, "Buffer could not be quoted due to unknown error."); |
---|
| 199 | |
---|
| 200 | return ret_val; |
---|
| 201 | break; |
---|
| 202 | |
---|
| 203 | |
---|
[111] | 204 | case REG_EXPAND_SZ: |
---|
[159] | 205 | ret_val = quote_string((char*)data->interpreted.expand_string, |
---|
| 206 | common_special_chars); |
---|
| 207 | if(ret_val == NULL && (*error_msg = (char*)malloc(49)) != NULL) |
---|
| 208 | strcpy(*error_msg, "Buffer could not be quoted due to unknown error."); |
---|
| 209 | |
---|
| 210 | return ret_val; |
---|
| 211 | break; |
---|
| 212 | |
---|
[111] | 213 | case REG_LINK: |
---|
[159] | 214 | ret_val = quote_string((char*)data->interpreted.link, common_special_chars); |
---|
| 215 | if(ret_val == NULL && (*error_msg = (char*)malloc(49)) != NULL) |
---|
[126] | 216 | strcpy(*error_msg, "Buffer could not be quoted due to unknown error."); |
---|
[159] | 217 | |
---|
| 218 | return ret_val; |
---|
[111] | 219 | break; |
---|
| 220 | |
---|
| 221 | case REG_DWORD: |
---|
[159] | 222 | ret_val = malloc(sizeof(char)*(8+2+1)); |
---|
| 223 | if(ret_val == NULL) |
---|
[111] | 224 | return NULL; |
---|
| 225 | |
---|
[159] | 226 | sprintf(ret_val, "0x%.8X", data->interpreted.dword); |
---|
| 227 | return ret_val; |
---|
[111] | 228 | break; |
---|
| 229 | |
---|
| 230 | case REG_DWORD_BE: |
---|
[159] | 231 | ret_val = malloc(sizeof(char)*(8+2+1)); |
---|
| 232 | if(ret_val == NULL) |
---|
[111] | 233 | return NULL; |
---|
| 234 | |
---|
[159] | 235 | sprintf(ret_val, "0x%.8X", data->interpreted.dword_be); |
---|
| 236 | return ret_val; |
---|
[111] | 237 | break; |
---|
| 238 | |
---|
| 239 | case REG_QWORD: |
---|
[159] | 240 | ret_val = malloc(sizeof(char)*(16+2+1)); |
---|
| 241 | if(ret_val == NULL) |
---|
[111] | 242 | return NULL; |
---|
| 243 | |
---|
[159] | 244 | sprintf(ret_val, "0x%.16llX", |
---|
| 245 | (long long unsigned int)data->interpreted.qword); |
---|
| 246 | return ret_val; |
---|
[111] | 247 | break; |
---|
[159] | 248 | |
---|
[111] | 249 | case REG_MULTI_SZ: |
---|
[159] | 250 | ret_val_left = data->interpreted_size*4+1; |
---|
| 251 | ret_val = malloc(ret_val_left); |
---|
| 252 | if(ret_val == NULL) |
---|
[111] | 253 | return NULL; |
---|
| 254 | |
---|
[159] | 255 | tmp_ptr = ret_val; |
---|
| 256 | tmp_ptr[0] = '\0'; |
---|
| 257 | delim = ""; |
---|
| 258 | for(i=0; data->interpreted.multiple_string[i] != NULL; i++) |
---|
[111] | 259 | { |
---|
[159] | 260 | cur_quoted = quote_string((char*)data->interpreted.multiple_string[i], |
---|
| 261 | subfield_special_chars); |
---|
| 262 | if(cur_quoted != NULL && cur_quoted[0] != '\0') |
---|
[136] | 263 | { |
---|
[159] | 264 | tmp_len = snprintf(tmp_ptr, ret_val_left, "%s%s",delim, cur_quoted); |
---|
| 265 | tmp_ptr += tmp_len; |
---|
| 266 | ret_val_left -= tmp_len; |
---|
| 267 | free(cur_quoted); |
---|
[136] | 268 | } |
---|
[159] | 269 | delim = "|"; |
---|
[126] | 270 | } |
---|
| 271 | |
---|
[159] | 272 | return ret_val; |
---|
[111] | 273 | break; |
---|
| 274 | |
---|
| 275 | |
---|
| 276 | case REG_NONE: |
---|
[159] | 277 | return quote_buffer(data->interpreted.none, data->interpreted_size, |
---|
| 278 | common_special_chars); |
---|
| 279 | |
---|
| 280 | break; |
---|
| 281 | |
---|
[111] | 282 | case REG_RESOURCE_LIST: |
---|
[159] | 283 | return quote_buffer(data->interpreted.resource_list, data->interpreted_size, |
---|
| 284 | common_special_chars); |
---|
| 285 | |
---|
| 286 | break; |
---|
| 287 | |
---|
[111] | 288 | case REG_FULL_RESOURCE_DESCRIPTOR: |
---|
[159] | 289 | return quote_buffer(data->interpreted.full_resource_descriptor, |
---|
| 290 | data->interpreted_size, common_special_chars); |
---|
| 291 | |
---|
| 292 | break; |
---|
| 293 | |
---|
[111] | 294 | case REG_RESOURCE_REQUIREMENTS_LIST: |
---|
[159] | 295 | return quote_buffer(data->interpreted.resource_requirements_list, |
---|
| 296 | data->interpreted_size, common_special_chars); |
---|
[111] | 297 | |
---|
[159] | 298 | break; |
---|
| 299 | |
---|
[111] | 300 | case REG_BINARY: |
---|
[159] | 301 | return quote_buffer(data->interpreted.binary, data->interpreted_size, |
---|
| 302 | common_special_chars); |
---|
| 303 | |
---|
[111] | 304 | break; |
---|
[159] | 305 | |
---|
| 306 | default: |
---|
| 307 | /* This shouldn't happen, since the regfi routines won't interpret |
---|
| 308 | * unknown types, but just as a safety measure against library changes... |
---|
| 309 | */ |
---|
| 310 | *error_msg = (char*)malloc(65); |
---|
| 311 | if(*error_msg == NULL) |
---|
| 312 | return NULL; |
---|
| 313 | sprintf(*error_msg, |
---|
| 314 | "Unrecognized registry data type (0x%.8X); quoting as binary.", |
---|
| 315 | data->type); |
---|
| 316 | return quote_buffer(data->raw, data->size, common_special_chars); |
---|
[111] | 317 | } |
---|
[159] | 318 | |
---|
[111] | 319 | return NULL; |
---|
| 320 | } |
---|
[172] | 321 | |
---|
| 322 | |
---|
| 323 | static char* get_quoted_keyname(const REGFI_NK_REC* nk) |
---|
| 324 | { |
---|
| 325 | char* ret_val; |
---|
| 326 | |
---|
| 327 | if(nk->keyname == NULL) |
---|
| 328 | ret_val = quote_buffer(nk->keyname_raw, nk->name_length, key_special_chars); |
---|
| 329 | else |
---|
| 330 | ret_val = quote_string(nk->keyname, key_special_chars); |
---|
| 331 | |
---|
| 332 | return ret_val; |
---|
| 333 | } |
---|
| 334 | |
---|
| 335 | |
---|
| 336 | static char* get_quoted_valuename(const REGFI_VK_REC* vk) |
---|
| 337 | { |
---|
| 338 | char* ret_val; |
---|
| 339 | |
---|
| 340 | if(vk->valuename == NULL) |
---|
| 341 | ret_val = quote_buffer(vk->valuename_raw, vk->name_length, |
---|
| 342 | key_special_chars); |
---|
| 343 | else |
---|
| 344 | ret_val = quote_string(vk->valuename, key_special_chars); |
---|
| 345 | |
---|
| 346 | return ret_val; |
---|
| 347 | } |
---|
[178] | 348 | |
---|
| 349 | |
---|
| 350 | int openHive(const char* filename) |
---|
| 351 | { |
---|
| 352 | int ret_val; |
---|
| 353 | |
---|
| 354 | /* open an existing file */ |
---|
| 355 | if ((ret_val = open(filename, REGLOOKUP_OPEN_FLAGS)) == -1) |
---|
| 356 | { |
---|
| 357 | fprintf(stderr, "ERROR: Failed to open hive. Error returned: %s\n", |
---|
| 358 | strerror(errno)); |
---|
| 359 | return -1; |
---|
| 360 | } |
---|
| 361 | |
---|
| 362 | return ret_val; |
---|
| 363 | } |
---|
| 364 | |
---|
| 365 | |
---|
| 366 | void formatTime(const REGFI_NTTIME* nttime, char* output) |
---|
| 367 | { |
---|
| 368 | time_t tmp_time[1]; |
---|
| 369 | struct tm* tmp_time_s = NULL; |
---|
| 370 | |
---|
| 371 | *tmp_time = regfi_nt2unix_time(nttime); |
---|
| 372 | tmp_time_s = gmtime(tmp_time); |
---|
| 373 | strftime(output, |
---|
| 374 | (4+1+2+1+2)+1+(2+1+2+1+2)+1, |
---|
| 375 | "%Y-%m-%d %H:%M:%S", |
---|
| 376 | tmp_time_s); |
---|
| 377 | } |
---|